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ACCURACY,    INTEGRITY,   AND  SECURITY 

IN 

COMPUTERIZED  VOTE-TALLYING 


Roy  G.  Saltman 


Recommendations  are  provided  to  promote  accuracy,  integrity,  and 
security  in  computerized  vote-tallying,  and  to  improve  confidence 
in  the  results  produced.  The  recommendations  respond  to  identi- 
fied problems,  and  concern  software,  hardware,  operational  pro- 
cedures,  and  institutional  changes. 

It  is  proposed  that  the  concept  of  internal  control,  almost  uni- 
versally used  to  protect  operations  that  produce  priced  goods  or 
services,  be  adapted  to  vote-tallying,  a  non-priced  service.  For 
software,  recommendations  concern  certification,  assurance  of 
logical  correctness,  and  protection  against  contamination  by  hid- 
den code.  For  hardware,  recommendations  concern  accuracy  of  bal- 
lot reading,  and  design  and  certification  of  vote-tallying  sys- 
tems that  do  not  use  ballots.  Improved  pre-election  testing  and 
partial  manual  recounting  of  ballots  are  recommended  operational 
procedures . 

Some  recent  significant  events  concerning  computerized  vote-tal- 
lying are  reported.  These  events  include  development  of  perfor- 
mance specifications,  publication  of  a  series  of  New  York  Times 
articles,  and  activities  in  Texas  leading  to  passage  of  a  revised 
statute  on  electronic  voting  systems.  Relative  vulnerabilities 
of  different  types  of  vote-tallying  systems,  i.e.,  punch  card, 
mark-sense,  and  direct  recording  electronic,  are  discussed.  Cer- 
tain recent  elections  in  which  difficulties  occurred  are  re- 
viewed, and  categories  of  failures  are  highlighted. 


Key  words:  accuracy;  computer;  election;  integrity;  internal 
control;  public  administration;  security;  vote-tallying. 
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1.    SUMMARY  OF  CONCLUSIONS  AND  RECOMMENDATIONS 


This  report  has  been  prepared  with  funding  provided  by  the  John 
and  Mary  R.  Markle  Foundation  of  New  York  City.  The  Markle  Foun- 
dation requested  that  the  National  Bureau  of  Standards  (NBS)  un- 
dertake this  study  because  of  concern  about  the  potential  for  in- 
accuracy or  fraud  in  computerized  vote-tallying.  NBS  was  ap- 
proached because  of  its  experience  with  the  subject  matter  as  a 
result  of  a  previous  project  undertaken  by  the  author  for  the 
U.S.  General  Accounting  Office. 

Concern  had  been  heightened  by  a  series  of  articles  published  in 
the  summer  of  1985  in  the  New  York  Times.  The  articles  cited 
statements  by  two  computer  experts  reporting  that  a  computer  pro- 
gram widely  used  for  vote-tallying  was  vulnerable  to  tampering. 
Several  elections  were  identified  in  which  losing  candidates 
claimed  that  it  would  be  possible  to  fraudulently  alter  the  com- 
puter programs  that  were  used  in  their  contests. 

1 . 1  Problems  Of  Computerized  Vote-Tallyincf 

In  preparation  for  this  report,  a  review  of  recent  public  state- 
ments and  documents  was  undertaken  that  indicated  concern  about 
computerized  vote-tallying.  The  review  showed  that  the  problems 
could  be  categorized  as  follows:  there  is  difficulty  in  verify- 
ing results;  there  is  the  possibility  of  undiscoverable  frauds; 
and  election  administrators  lack  some  necessary  knowledge  and  re- 
sources . 

While  proof  of  actual  computer  program  manipulation  appears  to 
be  lacking,  documentation  conclusively  demonstrating  otherwise  is 
generally  insufficient,  due  to  the  manner  in  which  many  comput- 
erized elections  are  conducted.  It  has  been  clearly  shown  that 
audit  trails  that  document  election  results,  as  well  as  general 
practices  to  assure  accuracy,  integrity,  and  security,  can  be 
considerably  improved. 

1 . 2  Government  Responsibilities 

The  recommendations  that  respond  to  these  problems  are  directed 
to  State  and  local  government  election  officials.  Elections  for 
State  and  Federal  offices  are  conducted  by  local  government  (gen- 
erally county,  township,  and  city)  administrators.  In  about  one- 
third  of  all  counties,  voting  is  carried  out  using  computerized 
equipment.  Jurisdictions  using  computerized  equipment  include 
over  one-half  of  all  registered  voters. 

Local  administrators  require  the  necessary  resources  and  exper- 
tise to  efficiently  and  effectively  carry  out  their  responsibili- 
ties. These  responsibilities  generally  include  procurement  of 
vote-tallying  systems  and  supporting  services.  An  effective  pro- 
curement must  include  specifications  that  assure  accuracy,  integ- 
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rity,  and  security.  The  local  administrators  also  have  the  re- 
sponsibility for  implementing  the  necessary  management  control 
systems  to  enable  the  public  to  have  confidence  in  the  results 
produced. 

Election  officials  require  a  source  of  neutral  expertise  for  the 
receipt  of  new  technical  and  administrative  information.  The  es- 
tablishment of  the  Election  Center  in  the  Academy  for  State  and 
Local  Government  clearly  fulfills  a  need.  Its  efforts  should  be 
expanded . 

1 . 3  Implementation  Of  An  Internal  Control  Function 

Internal  control  is  a  set  of  systematic  procedures  used  to  guard 
against  errors,  waste,  and  fraud.  It  is  nearly  universally  used 
as  a  management  technique  to  safeguard  assets,  and  to  protect  op- 
erations that  result  in  goods  or  services  priced  for  sale.  Vot- 
ing services  are  not  priced,  and  the  discipline  of  internal  con- 
trol has  not  been  systematically  applied.  Applicability  of  the 
discipline  to  vote-tallying  requires  only  the  re-definition  of 
the  concept  of  a  transaction.  A  transaction  is  now  defined  as  a 
business  event  that  is  measured  in  money  and  that  is  entered  into 
accounting  records;  a  re-definition  would  allow  a  transaction  to 
include  a  step  in  the  implementation  of  an  entitlement  that  is 
not  measured  in  money. 

Essential  recommendations  are  that  the  concept  of  internal  con- 
trol should  be  re-defined  as  indicated,  and  that  persons  know- 
ledgeable in  that  professional  field  should  be  utilized  to  assist 
in  the  establishment  and  implementation  of  sound  operational  pro- 
cedures. To  the  extent  that  procured  computerized  voting  equip- 
ment and  software  must  have  capabilities  that  support  internal 
control,  applicable  requirements  should  be  included  in  procure- 
ment specifications. 

Expertise  in  internal  control  (which  includes  computer  security) 
should  be  added  to  the  personnel  complement  in  election  adminis- 
tration in  order  to  assure  implementation  of  applicable  concepts. 
In  addition,  an  internal  auditor  should  be  available  to  indepen- 
dently review  the  implementation  of  internal  controls  and  report 
on  their  effectiveness.  Internal  control  is  a  professional  ac- 
tivity; trained  persons,  texts,  and  a  community  of  practitioners 
are  available.  Internal  control  expertise  may  be  shared  among 
government  agencies  or  provided  at  the  State  level  if  individual 
agency  resources  are  insufficient. 

An  important  function  of  internal  control  is  to  identify  system 
vulnerabilities  and  convert  them  into  a  set  of  realistic  threats. 
Responses  must  be  devised  that  are  consistent  with  available  or 
obtainable  resources,  based  on  a  risk  analysis  determining  the 
likelihood  and  cost  of  actual  exploitation  of  a  particular  vul- 
nerability.     As  a  result,    internal   controls  personnel  should  be 
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able  to  provide  assurances  to  the  public  that  the  potential 
threats  are  understood,  have  been  prioritized  for  significance, 
and  are  being  countered. 

The  availability  of  internal  control  specialists  should  relieve 
election  administrators  from  having  to  be  personally  knowledge- 
able about  specific  technical  matters  best  left  to  individuals 
who  are  professionally  qualified  in  that  field.  With  the  addi- 
tion of  needed  technical  resources  to  the  staff,  election  admi- 
nistrators would  be  able  to  retain  management  control.  Adminis- 
trators would  not  have  to  abdicate  control  to  others,  such  as 
vendors  or  data  processing  center  directors.  Thus,  election  ad- 
ministrators would  be  able  to  retain  the  capability  of  managing 
the  process  of  assuring  accuracy,  integrity,  and  security  in 
vote-tallying. 

1 . 4  FEC  Clearinghouse  Specifications 

The  performance  specifications  being  developed  by  the  National 
Clearinghouse  on  Election  Administration  of  the  Federal  Election 
Commission  (FEC  Clearinghouse)  are  approaching  completion.  They 
are  intended  for  Statewide  adoption.  Each  State  should  consider 
the  adoption  of  these  specifications  when  they  are  issued. 

Acceptance  procedures  for  hardware  and  software  should  be  consis- 
tent with  the  FEC  Clearinghouse  implementation  plan  for  adoption 
of  these  specifications.  That  plan  calls  for  qualification  and 
certification  prior  to  final  acceptance.  Qualification  implies 
conformance  with  standards  and  functional  requirements,  and  may 
be  done  once  to  satisfy  many  States.  Certification  ensures  that 
the  product  meets  State  requirements.  Acceptance  testing  evalu- 
ates the  degree  to  which  the  specific  units  delivered  to  the  lo- 
cal government  conform  to  approved  characteristics. 

1.5  Revised  Texas  Statute  On  Electronic  Voting  Systems 

The  requirements  of  the  revised  Texas  statute  on  electronic  vot- 
ing systems  should  be  considered  for  adoption  in  those  States 
that  have  not  already  adopted  equivalent  or  more  stringent  provi- 
sions. Requirements  of  the  Texas  statute  include  audit  trails, 
deposit  of  computer  programs  with  the  secretary  of  state,  assur- 
ance that  programs  used  in  vote-tallying  are  identical  to  those 
deposited,  mandatory  one  percent  manual  recount  of  all  contests, 
testing  of  equipment  using  all  applicable  ballot  formats,  discon- 
nect of  remote  terminals  during  vote  tabulations,  and  specific 
scrutiny  of  ballot  count  discrepancies. 

1 . 6  Recommendations  On  Software 
1.6.1  Certification 

Products  to  be  certified  should  include  all  vote-tallying  soft- 
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ware  and  all  software  to  be  mounted  together  with  vote-tallying 
software.  Certification  implies  State  approval.  Only  certified 
software  should  be  permitted  to  be  used  within  the  State.  After 
software  has  been  certified,  no  design  changes  should  be  permit- 
ted without  a  re-certification.  All  software  that  has  been  cer- 
tified should  be  deposited  with  the  chief  election  official  of 
the  State.  Consistent  with  the  revised  Texas  statute,  the  mate- 
rials on  file  should  not  be  public  information,  but  should  be 
available  to  law  enforcement  authorities,  on  proper  application, 
for  investigation  of  election  irregularities. 

Specialization  of  vote-tallying  software  for  a  particular  elec- 
tion should  occur  only  with  a  "f ill-in-the-blanks"  procedure,  not 
with  logic  design  changes.  Header  cards  used  in  vote-tallying 
operations  should  not  change  the  logic  of  a  program. 

1.6.2  Integrity  and  Logical  Correctness 

As  a  requirement  for  certification,  all  vote-tallying  software, 
and  all  software  used  with  it,  should  be  reviewed  for  integrity, 
that  is,  for  the  ability  to  carry  out  its  asserted  function  and 
to  contain  no  hidden  code.  Vote-tallying  software  should  be 
tested,  in  addition,  for  logical  correctness.  Vote-tallying 
software  includes  software  for  election  specialization  and  ballot 
generation,  as  well  as  vote-summarizing  software.  Satisfaction 
of  the  requirements  may  be  done  as  part  of  qualification. 

As  part  of  the  effort  to  maintain  integrity  of  software,  account- 
ability of  the  source  is  essential.  Copying  of  software  from  un- 
accountable sources  must  be  forbidden.  To  minimize  requirements 
for  testing,  all  software  should  be  obtained  from  a  stock  of 
products  offered  publicly  by  reputable  vendors.  Software  that 
cannot  be  obtained  in  this  manner  must  be  thoroughly  checked. 

1.6.3  Dedicated  Software  Use  and  Dedicated  Operation 

An  important  procedure  to  assure  system  integrity  is  to  isolate 
vote-tallying  and  support  software  from  influences  over  which  the 
election  administration  has  no  control. 

After  all  software  to  be  used  together  has  been  certified,  it 
should  be  maintained  separately  under  the  control  of  the  election 
administration  and  not  used  together  with  uncertified  software. 
It  is  strongly  recommended  that  certified  vote-tallying  software 
not  be  allowed  to  run  on  a  multiprogrammed  general-purpose  com- 
puter on  which  uncertified  support  software  or  applications  also 
are  being  run. 
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1 . 7  Recommendations  On  Hardware 


1.7.1  Accuracy  Of  Ballot  Reading 

The  value  of  a  ballot-tallying  system  is  that  it  should  be  pos- 
sible, with  a  recount,  to  duplicate  the  result  of  an  election. 
The  problems  found  in  ballot-reader  inaccuracy,  both  in  the  count 
of  ballots,  and  in  the  count  of  votes  on  ballots,  are  a  signifi- 
cant source  of  lack  of  confidence  in  vote-tallying. 

A  recommended  goal  is  that  a  computerized  vote  count  should  be 
able  to  be  reproduced  on  a  recount  with  no  more  than  a  change  in 
one  vote  for  each  ballot  position  in  ballot  quantities  of  up  to 
100,000  when  machine-generated  (ideal)  ballots  are  used.  A  bal- 
lot reader  should  be  able  to  tolerate  a  wide  range  of  punching  or 
marking  behavior  by  a  voter  without  a  significant  increase  in  er- 
ror. 

1.7.2  Elimination  of  Pre-Scored  Punch  Card  Ballots 

The  use  of  pre-scored  punch  cards  contributes  to  the  inaccuracy 
and  to  the  lack  of  confidence.  It  is  generally  not  possible  to 
exactly  duplicate  a  count  obtained  on  pre-scored  punch  cards, 
given  the  inherent  physical  characteristics  of  these  ballots  and 
the  variability  in  the  ballot-punching  performance  of  real  vot- 
ers . 

It  is  recommended  that  the  use  of  pre-scored  punch  card  ballots 
be  ended.  One  method  now  available  to  eliminate  pre-scored 
cards,  while  retaining  the  "votomatic"  concept,  is  with  a  new 
type  of  hole-punching  stylus  that  uses  spring-loading.  A  hole  of 
consistent  and  acceptable  dimensions  can  be  created  by  a  voter 
using  the  new  stylus  without  the  need  for  pre-scoring.  The  in- 
ternal construction  of  the  "votomatic"  ballot  holder  must  be  al- 
tered with  the  use  of  the  new  stylus.  Other  devices  and  methods 
for  elimination  of  pre-scored  punch  card  ballots  also  may  be  ef- 
fective. 

1.7.3  Counting  of  Rejected  Ballots 

If  a  ballot  cannot  be  read  by  machine,  administrative  controls 
should  be  in  place  to  permit  such  ballots  to  be  counted  manually. 
A  voter's  choices  should  not  be  lost  because  of  machine  failure. 

1.7.4  Required  Research 

Testing  to  determine  the  accuracy  of  current  ballot  reading  sys- 
tems (such  as  that  now  being  carried  out  by  ECRI  of  Plymouth 
Meeting,  PA) ,  and  research  to  improve  ballot  tallying  systems  in 
accuracy  and  ease  of  voter  use,  are  important  to  pursue. 
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1.7.5  Design  of  Direct  Recording  Electronic  (DRE)  Machines 

With  DRE  machines,  no  ballot  is  used.  The  voter  enters  choices 
directly  into  a  storage  unit  of  the  machine  with  the  use  of  push- 
buttons, a  touch-screen,  or  similar  devices.  As  no  voter-gener- 
ated records  of  choices  exist,  and  no  recount  independent  of  the 
machine  is  possible,  steps  should  be  taken  in  the  design  of  these 
machines  to  assure  complete  confidence  in  the  reported  results. 

A  problem  with  most  DRE  machines  as  currently  designed  (as  with 
lever  machines,  their  predecessors)  ,  is  that  there  is  no  differ- 
ence in  the  results  seen  between  a  voter's  failure  to  cast  a  vote 
and  the  machine's  failure  to  record  a  vote. 

Recording  of  Undervotes;  It  is  recommended  that  each  DRE  machine 
be  designed  so  as  to  take  a  positive  action  indicating  a  "no 
vote"  for  every  choice  that  the  voter  fails  to  take.  When  voting 
is  complete,  the  voter's  choices,  and  any  "no  votes"  for  votes 
not  taken,  would  be  transferred  to  a  more  permanent  storage  for 
summation  with  other  voters'  choices.  The  required  transfer  and 
summation  of  the  "no  votes"  would  serve  as  positive  indications 
of  the  voter's  failure  to  make  certain  specific  choices.  Thus, 
there  would  be  no  ambiguity  about  whether  the  voter  failed  to 
vote  or  the  machine  failed  to  record  selections. 

Retention  of  Voter-Choice  Sets  for  Summation  Verification:  Each 
voter-choice  set  (i.e.,  the  machine's  record  of  all  choices  of  a 
voter)  should  be  retained  in  the  machine  on  a  removable  non-vola- 
tile medium  (e.g.,  magnetic  disk).  Storage  locations  of  the  vot- 
er-choice sets  would  have  to  be  randomized  to  prevent  association 
of  a  particular  set  with  a  particular  voter.  The  retention  of 
the  voter-choice  sets  makes  possible  a  verification  (on  an  inde- 
pendent machine)  of  the  DRE  machine's  summation  of  the  voters' 
choices  that  it  recorded.  The  correctness  of  the  machine's  data 
entry  process  cannot  be  checked  in  this  manner. 

1.7.6  Certification  of  DRE  Data  Entry  Logic 

DRE  data  entry  hardware  should  be  certified  for  logical  correct- 
ness, by  examination  of  the  logic  design  and  by  testing  under  a 
large  variety  of  different  conditions.  The  DRE  data  entry  func- 
tion must  be  correct,  as  there  are  no  ballots  to  provide  an  inde- 
pendent check.  The  data  entry  logic  and  its  documentation  should 
be  deposited  with  the  State,   as  described  above  in  1.6.1. 

1 . 8  Recommendations  On  Operational  Procedures 

1.8.1  Pre-Election  Checkout 

Lack  of  sufficient  pre-election  testing  appears  to  be  a  major 
source  of  operational  difficulty.  Sufficient  pre-election  test- 
ing should  be  done   so  that  errors  in  software  specialization  or 
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in  implementation  of  logical  rules,  if  any,  will  become  obvious. 
It  is  recommended  that  to  the  greatest  extent  possible,  all  hard- 
ware and  software  to  be  utilized  should  be  given  a  dry  run  simu- 
lating specific  conditions  to  be  faced  on  election  day  and  elec- 
tion night. 

1.8.2  Audit  Trails 

Audit  trails  provide  the  supporting  documentation  through  which 
the  correctness  of  the  reported  results  may  be  verified.  Two 
types  of  audit  trails  are  necessary  to  document  operations  and 
provide  confidence  in  the  results  reported.  One  type  records 
steps  in  the  operation  of  the  equipment,  while  the  other  records 
steps  in  the  voting  and  vote-tallying  processes. 

1.8.3  Complete  Data  From  Split  Precincts 

Each  split  of  a  split  precinct  should  be  treated  like  a  separate 
precinct  for  the  reporting  of  ballots  and  votes  cast.  However, 
voter  privacy  must  be  a  concern  for  splits  containing  a  very 
small  number  of  voters. 

1.8.4  Access  Controls 

Access  (i.e.,  security)  controls  must  be  in  place  during  prepara- 
tions for  voting,  voting  itself,  and  vote-tallying.  These  con- 
trols concern  access  to  sites,  areas,  facilities,  equipment,  doc- 
uments, files,  and  data.  The  controls  cover  transportation  of 
ballots  and  telecommunication  of  results. 

1.8.5  Application  Internal  Controls  for  Ballot-Tallying  Systems 

These  controls  should  be  in  place  to  prevent  all  types  of  ballot 
frauds  and  miscounting  errors,  and  to  provide  the  documentation 
and  assurance  that  the  correct  results  are  reported.  Controls  on 
ballots  cover  printing  and  distribution,  accounting  for  use,  va- 
lidity, and  prevention  of  errors  due  to  mishandling.  Controls  on 
data  and  calculations  provide  for  accurate  telecommunication  of 
data,  recording  of  undervotes  and  overvotes,  vote  reconciliations 
that  demonstrate  consistency,  and  assurance  of  accurate  vote  sum- 
marization. A  manual  recount  of  at  least  one  percent  of  the  bal- 
lots of  each  contest  is  recommended.  Responsibility  for  selec- 
tion of  some  of  the  precincts  to  be  recounted  should  be  granted 
to  candidates  or  parties. 

1.8.6  Application  Internal  Controls  for  DRE  Systems 

These  controls  should  be  in  place  to  provide  documentation  and 
assurance  that  the  correct  results  are  reported  when  DRE  systems 
are  used.  The  controls  cover  matching  machine  use  with  voter  to- 
tals, vote  reconciliations  on  each  machine,  recounting  of  voter- 
choice  sets,   and  post-election  checkout  of  machines. 
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1.9  Relative  Vulnerabilities  Of  Different  System  Types 

Each  type  of  system  has  its  own  particular  vulnerabilities.  A 
comparison  of  system  types  shows  that  each  has  its  advantages  and 
disadvantages.  It  is  possible  to  effectively  utilize  any  of  the 
computerized  systems  discussed  (punch  card,  mark-sense,  or  DRE) 
provided  that,  among  other  requirements,  procurement  specifica- 
tions are  well-written  in  accordance  with  needed  performance,  and 
factors  of  accuracy,  reliability,  and  recommended  design  concepts 
are  included  in  the  specifications. 

1. 10  Review  Of  Recent  Difficulties  In  Computerized  Vote-Tallying 

Ten  computerized  voting  situations  in  which  difficulties  occurred 
are  reviewed  in  detail  in  this  report.  The  four  situations  iden- 
tified in  the  New  York  Times  article  of  July  29,  1985  are  among 
those  reviewed.  Problems  in  several  other  situations  are  briefly 
described. 

Although  none  of  the  situations  has  provided  solid  evidence  of 
computer  program  manipulation,  the  reviews  have  revealed  the  need 
for  improvements  in  hardware  and  software  performance  and  in  op- 
erational procedures,  and  they  have  provided  support  for  the  need 
for  institutional  changes.  Thus,  the  reviews  have  influenced  the 
recommendations  provided  in  this  report. 

Specific  recommendations  directly  resulting  from  the  reviews  of 
difficulties  include  the  recommendations  on  improved  accuracy  in 
ballot  tabulation,  elimination  of  pre-scored  punch  card  ballots, 
assurance  of  the  counting  of  ballots  rejected  by  readers,  provi- 
sion of  complete  data  from  split  precincts,  and  more  thoroughness 
in  pre-election  checkout. 

1. 11  Future  Vote-Tallying  Systems 

While  vote-tallying  using  telephones  or  stations  similar  to  auto- 
matic teller  machines  is  technologically  feasible,  the  decision 
to  implement  such  a  system  must  be  based  on  more  fundamental  fac- 
tors. Any  installed  system  must  meet  political  and  economic  re- 
quirements, as  well  as  technical  requirements  of  accuracy  and  re- 
liability. Political  needs  include  equal  access  by  individuals, 
the  ability  to  verify  registration,  and  the  ability  of  the  voters 
to  vote  in  secret  without  intimidation.  Internal  controls  must 
be  implementable  to  demonstrate  the  correctness  of  the  reported 
results.  Benefits,  such  as  increased  voter  convenience  and  pos- 
sible improved  participation  rates,  must  be  compared  against  the 
costs  of  implementation. 
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2.    BACKGROUND.   AND  RECENT  SIGNIFICANT  EVENTS 


This  report  has  been  prepared  in  partial  fulfillment  of  the  con- 
ditions of  funding  received  in  November,  1986,  by  the  Institute 
for  Computer  Sciences  and  Technology  (ICST)  of  NBS  from  the  John 
and  Mary  R.  Markle  Foundation  of  New  York  City.  The  Markle  Foun- 
dation is  privately  endowed,  and  has  a  programmatic  interest  in 
the  role  of  computer  technology  and  communications  in  public  af- 
fairs. 

As  a  nonregulatory  agency  of  the  U.S.  Department  of  Commerce,  NBS 
was  established  in  1901  specifically  to  aid  manufacturing,  com- 
merce, government,  and  academia  through  application  of  its  exper- 
tise in  science  and  technology.  In  connection  with  its  consult- 
ing role,  NBS  may  accept  outside  funding  that  is  consistent  with 
its  mission  and  programs. 

ICST  carries  out  the  responsibilities  mandated  to  the  Department 
of  Commerce  under  the  Brooks  Act  (P.L.  89-306).  ICST  develops 
techniques  and  tools  to  help  organizations  make  more  effective 
use  of  computers  and  information  technology.  In  addition,  ICST 
serves  government  and  industry  by  developing  Federal  Information 
Processing  Standards  (FIPS) ,  technical  reports,  and  test  methods, 
and  by  providing  technical  assistance  to  advance  new  uses  of  com- 
puter technology.  In  1987,  additional  responsibilities  were  as- 
signed to  ICST  due  to  the  passage  of  the  Computer  Security  Act 
(P.L.  100-235).  In  accordance  with  this  act,  ICST  will  develop 
standards  and  guidelines  on  computer  security  to  protect  the  U.S. 
Government's  sensitive  but  unclassified  information. 

2 . 1  Accuracy.   Integrity,  And  Security 

This  report  concerns  measures  to  assure  the  presence  of  accuracy, 
integrity,  and  security  in  computerized  vote-tallying.  Accuracy 
is  the  essential  requirement  of  a  computerized  vote-tallying  sys- 
tem, but  its  achievement  may  not  be  possible  without  the  imple- 
mentation of  integrity  and  security.  Even  if  accuracy  is  at- 
tained, confidence  in  the  results  may  not  be  assured  unless  the 
other  two  factors  can  be  shown  to  be  present.  Thus,  for  vote- 
tallying  systems,  these  factors  are  not  mutually  exclusive  param- 
eters that  can  be  separately  considered. 

Definitions,   for  the  purpose  of  this  report,   are  as  follows: 

accuracy:  conformity  of  the  output  data  of  a  vote-tallying  system 
with  logically  correct  and  acceptably  precise  treatment  of  all 
input  data  provided  to  the  system; 

integrity:  the  state  of  a  vote-tallying  system  in  which  it  will 
correctly  perform  the  functions  specified  for  it,  and  only  those 
functions ; 
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security:  the  achievement  of  a  desired  control  of  access  to  vote- 
tallying  facilities,  areas,  equipment,  supplies,  documents,  me- 
dia,  files,  and  data. 

2.2  ICST's  1974/1975  Project  On  Computerized  Voting 

The  origins  of  the  current  project  go  back  to  1974.  In  February 
of  that  year,  ICST  was  asked  by  the  General  Accounting  Office 
(GAO)  to  "conduct  a  systems  analysis  and  evaluation  of  the  role 
of  automatic  digital  processing  equipment  in  the  vote-tallying 
process."  The  year-long  project,  undertaken  also  by  the  author 
of  this  latest  report,  was  completed  in  1975. 

The  project  had  been  requested  by  the  GAO  through  one  of  its  com- 
ponents, the  National  Clearinghouse  on  Election  Administration  of 
the  Office  of  Federal  Elections,  in  recognition  of  concerns  ex- 
pressed in  Congress,  and  by  election  officials  and  the  public, 
about  the  use  of  computing  technology  in  vote-tallying.  These 
concerns  had  been  aroused  by  the  issue  of  the  potential  for  the 
fraudulent  alteration  of  vote-tallying  computer  programs,  and  by 
actual  difficulties  experienced  in  computer-based  elections.  The 
possibility  of  fraudulent  manipulation  of  computer  programs  had 
been  raised  by  computer  experts  in  Los  Angeles  in  1969.  Serious 
problems  in  computerized  vote-tallying  had  been  experienced  in 
San  Francisco  in  1968,  in  Los  Angeles  and  Detroit  in  1970,  in  Los 
Angeles  and  Houston  in  1972,  and  in  other  places  in  the  years  im- 
mediately prior  to  the  request  for  the  report. 

The  product  of  the  1974/1975  project  was  a  report  entitled  Effec- 
tive Use  of  Computing  Technology  in  Vote-Tallying  [1].  The  re- 
port identified  the  hardware,  software,  and  administrative  prob- 
lems that  had  been  encountered  at  that  time,  and  specified  opera- 
tional guidelines  that  election  administrators  could  implement  to 
help  assure  the  accuracy  and  security  of  the  vote-tallying  pro- 
cess. Several  thousand  copies  of  the  report  were  distributed  to 
election  administrators  throughout  the  nation  by  the  National 
Clearinghouse  on  Election  Administration.  That  organization,  in 
1975,  had  become  a  part  of  the  newly  established  Federal  Election 
Commission;  it  is  identified  elsewhere  in  this  report  as  the  FEC 
Clearinghouse . 

2 . 3  Some  Pertinent  Technological  Changes  Since  1975 

Since  the  1975  report,  there  have  been  many  additional  experi- 
ences in  the  application  of  computerized  vote-tallying,  and  con- 
siderable improvements  in  computer  technology.  In  computer  hard- 
ware, the  most  important  changes  have  been  improved  speeds  of  op- 
eration, smaller  physical  size,  and  availability  of  larger  quan- 
tities of  random  access  and  disk  memory.  The  improved  speeds  and 
memory  quantities  are  obtainable  at  considerable  reductions  in 
cost.  The  lower  costs  and  improvements  in  technology  have  made 
possible  the  proliferation  of  smaller  computers  with  considerable 
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capability.  Thus,  it  is  now  possible  for  many  smaller  election 
administrations  to  consider  the  acquisition  of  their  own  comput- 
ing power,  in  order  to  achieve  efficiencies  and  provide  more  di- 
rect management  control  over  their  operations. 

There  has  been,  also,  continued  improvements  in  tools  and  tech- 
niques for  the  management  of  technology.  Tools  include  the 
availability  of  new  standards  in  computer  technology  such  as  for 
media,  programming  languages,  communications  protocols,  and  data 
protection.  Techniques  include  the  concepts  of  software  engi- 
neering, computer  security,  internal  control,  and  EDP  (electron- 
ic data  processing)  auditing. 

The  changes  in  computer  technology,  and  the  availability  of  new 
tools  and  techniques,  have  been  considered  in  the  development  of 
the  recommendations  of  this  report. 

2 . 4  Development  Of  Standards  For  Voting  Equipment 

In  January,  1980,  partly  as  a  result  of  the  1975  ICST  report. 
Congress  adopted  P.L.   96-187,   Section  302,  which  stated  that: 

"The  Federal  Election  Commission,  with  the  cooperation 
and  assistance  of  the  National  Bureau  of  Standards, 
shall  conduct  a  preliminary  study  with  respect  to  the 
future  development  of  voluntary  engineering  and  proce- 
dural performance  standards  for  voting  systems  used  in 
the  United  States.  The  Commission  shall  report  to  the 
Congress  the  results  of  the  study,  and  such  report 
shall  include  recommendations,  if  any,  for  the  imple- 
mentation of  a  program  of  such  standards  (including 
estimates  of  the  costs  and  time  requirements  of  imple- 
menting such  a  program)  .  The  cost  of  the  study  shall 
be  paid  out  of  any  funds  otherwise  available  to  defray 
the  expenses  of  the  Commission." 

In  1983,  the  preliminary  study  was  completed  with  the  recommenda- 
tion that  "performance  standards  for  voting  systems  are  both 
needed  and  feasible."  In  1984,  the  FEC  Clearinghouse  began  to 
develop  such  standards.  As  of  the  summer  of  1988,  the  hardware, 
software,  and  test  standards  for  punch  card,  mark-sense,  and  DRE 
voting  systems  are  approaching  completion  [2].  An  executive  sum- 
mary of  these  standards  also  is  being  prepared  [3].  The  FEC 
Clearinghouse  has  also  prepared  a  draft  implementation  plan  for 
the  voting  system  standards  [4],  and  a  "System  Escrow  Plan"  [5]. 
The  latter  concerns  the  problem  of  controlling  access  to  proprie- 
tary source  code  while  States  and  local  governments  (or  their 
agents)  are  provided  with  the  ability  to  test  the  vote-tallying 
software  for  integrity. 

Implementation  of  the  standards  would  address  some  of  the  identi- 
fied problems   of   computerized  vote-tallying  summarized  below  in 
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section  2.9. 

2.5  Establishment  Of  The  Election  Center 

The  Election  Center,  affiliated  with  the  Academy  for  State  and 
Local  Government,  was  established  in  1984.  The  Center  is  an  in- 
dependent non-profit  resource  center  serving  registration  and 
election  officials.  National  and  regional  election  conferences 
sponsored  by  the  Center,  as  well  as  reports  and  other  data  dis- 
tributed to  officials,  provide  training  and  information  in  some 
thirty-five  areas  of  election  administration. 

The  Center  has  recently  distributed  the  report  of  a  workshop 
[107]  held  on  Captiva  Island,  Florida,  in  February,  1987.  The 
workshop  concerned  computerized  vote-tallying  and  included,  as 
participants,  election  officials,  vendors,  computer  scientists, 
and  others  interested  in  the  election  process.  The  workshop  was 
funded  by  grants  to  the  George  Washington  University  by  the  John 
and  Mary  R.  Markle  Foundation.  The  Election  Center  had  no  part 
in  the  workshop  but,  because  of  its  clientele,  served  as  a  con- 
venient avenue  of  distribution  for  the  report. 

The  Academy  for  State  and  Local  Government  is  a  non-profit  re- 
search organization  that  fosters  understanding  of  American  gov- 
ernment at  all  levels.  The  Academy  is  governed  by  a  board  of 
trustees  composed  of  the  executive  directors  of  seven  organiza- 
tions representing  States,  counties,  cities,  and  the  chief  offi- 
cials of  these  jurisdictions. 

2 . 6  New  York  Times  Articles  On  Computerized  Voting 

A  series  of  articles  on  computerized  voting  was  published  in  the 
New  York  Times  in  1985,  commencing  on  July  29  of  that  year.  In 
the  first  article,  published  on  page  one  and  entitled  "Computer- 
ized Systems  for  Voting  Seen  as  Vulnerable  to  Tampering"  [6],  it 
was  charged  that: 

"The  computer  program  that  was  used  to  count  more  than 
one-third  of  the  votes  cast  in  the  Presidential  elec- 
tion last  year  is  very  vulnerable  to  manipulation  and 
fraud,  according  to  expert  witnesses  in  court  actions 
challenging  local  and  Congressional  elections  in  three 

S't'3.'t6S  •  •  • 

"The  vote  counting  program  that  has  been  challenged  in 
Indiana,  West  Virginia  and  Maryland  was  developed  by 
Computer  Election  Systems  of  Berkeley,  Calif.  In  Indi- 
ana and  West  Virginia,  the  company  has  been  accused  of 
helping  to  rig  elections.  The  computer  program  has 
also  been  challenged  in  Florida,  but  so  far  experts 
have  not  been  permitted  to  examine  the  program  in  con- 
nection with  the  challenge. 
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"John  H.  Kemp,  president  of  Computer  Election  Systems, 
said  in  a  telephone  interview  that  he  absolutely  denied 
that  the  company  was  involved  in  fraudulent  schemes. 
County  officials  involved  in  the  cases  also  have  cate- 
gorically denied  participation  in  fraud." 

The  article  went  on  to  state  that  allegations  that  the  computer 
program  provided  by  Computer  Election  Systems  was  "open  to  mani- 
pulation and  fraud  were  supported  by  two  . . .  experienced  computer 
consultants  who  independently  examined  material  obtained  in  the 
pending  court  cases  for  the  New  York  Times."  The  two  experts 
cited  were  Howard  Jay  Strauss,  associate  director  of  the  Prince- 
ton University  Computer  Center,  and  Eric  K.  Clemons,  an  associate 
professor  of  decision  sciences  at  the  Wharton  School  of  the  Uni- 
versity of  Pennsylvania. 

Mr.  Strauss  was  reported  as  saying  that  "the  program  used  to 
count  Indiana  votes  was  vulnerable  to  manipulation."  He  was  ad- 
ditionally quoted  as  follows: 

"  'Extra  votes  may  be  entered  in  the  form  of  bogus  bal- 
lots on  punch  cards,  or  vote  totals  may  be  altered 
through  the  use  of  control  cards,  '  Mr.  Strauss  said. 
'Either  of  these  assaults  on  the  system  could  be  per- 
formed successfully  by  a  computer  novice. ' 

"Mr.  Strauss  added  that  someone  with  'a  fair  amount  of 
computer  knowledge'  could  turn  off  the  portion  of  the 
program  designed  to  document  any  changes  made  in  either 
the  program  or  the  votes  being  counted  by  the  program." 

However,  an  examination  of  the  complete  text  submitted  by  Mr. 
Strauss  to  the  New  York  Times  shows  that  he  also  stated  that: 

"If  a  better  audit  trail  was  part  of  the  program,  and 
if  better  procedures  were  followed  in  running  the  pro- 
gram, then  all  of  the  assaults  on  the  system  described 
above  [for  entering  extra  votes  or  altering  votes] 
could  easily  be  detected.  ,  . 

In  addition,  in  response  to  the  question,  "Can  the  program  be 
made  safer?"  Mr.  Strauss  responded: 

"...there  is  no  way  to  design  a  tamper  proof  program. 
If  prudent  procedures  are  not  followed  in  running  it, 
any  program  can  be  compromised.  The  NBS  publication 
Effective  Use  of  Computing  Technology  in  Vote-Tallvinq 
makes  this  point  very  clearly  and  provides  reasonable 
guidelines  for  designing  and  running  vote-tallying  pro- 
grams." [7] 
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These  qualifying  remarks  were  not  reported  in  the  New  York  Times 
article. 

Professor  demons  was  quoted  in  the  July  29,  1985  article  as 
saying  that  because  of  the  excessive  complexity  of  the  program, 

"  '...a  doctored  version  of  the  code  could  be  used  to 
modify  election  results,  and  it  would  take  weeks  of 
study  to  determine  what  had  happened. ' 

"  'Code  this  complex  is  very  difficult  to  trust, '  Mr. 
demons  said.  One  particular  flaw  that  he  cited  was 
that  'the  main  program  does  not  log  all  invalid  bal- 
lots. '  Another  was  that  the  printed  log  of  error  mes- 
sages could  easily  by  edited  or  altered." 

An  examination  of  the  complete  text  submitted  by  Professor  Cle- 
mens to  the  New  York  Times  shows  that  he  also  stated  that: 

'  "This  does  not  mean  that  the  code  was  constructed  this 

way  in  deliberate  violation  of  [FEC  Clearinghouse]  re- 
commendations or  current  practice;  this  was  a  very  com- 
mon programming  style  in  the  60s  and  mid-70s.  And  it 
does  not  mean  that  anyone  is  using  the  system  to  influ- 
ence election  results."  [8] 

These  qualifying  remarks,  similarly,  were  not  included  in  the  New 
York  Times  article. 

The  July  29,  1985  article  was  distributed  by  the  New  York  Times 
News  Service,  and  also  appeared,  in  whole  or  in  part,  in  other 
papers,  including  the  Greensboro  (NC)  News  &  Record  and  the  Nor- 
folk (VA)  Virginian-Pilot. 

Another  article  in  the  series,  on  August  21,  1985,  entitled  "Vote 
by  Computer:  Some  See  Problems"   [9],   reported  that: 

"Many  local  election  officials  are  baffled  by  computers 
and  are  unable  to  understand,  question  and  challenge 
the  computer  systems. 

"Election  system  vendors  are  often  forced  by  competi- 
tive bidding  pressures  to  offer  jurisdictions  the 
cheapest  possible  systems,  and  the  products  they  offer 
do  not  maximize  fraud  protection." 

In  explanation,  the  article  continued: 

"The  industry  has  been  faced  with  competition  to  pro- 
duce low-cost  systems  that  can  produce  a  quick  tally, 
but  it  has  not  devoted  much  attention  to  devising  sys- 
tems  that    could   be   understood  by   local   officials  and 
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that   would    provide    features    such    as    audit    trails  to 
make  fraud  difficult." 

2 . 7  California  Attorney  General's  Report 

In  December,  1985,  the  Office  of  the  Attorney  General  of  the 
State  of  California  began  a  study  that  was  "prompted  ...  by  sev- 
eral nationally  published  news  stories"  [10],  by  which  the  New 
York  Times  series  was  meant.  The  study  concentrated  on  "an 
analysis  of  the  nature  and  extent  of  reported  problems  attending 
the  computerization  of  the  vote  counting  process"  [11].  Almost 
every  county  in  California  uses  computerized  vote-tallying  sys- 
tems, and  the  systems  include  a  significant  number  provided  by 
the  vendor  named  by  the  New  York  Times. 

The  report,  on  April  23,  1986  by  Robert  R.  Granucci,  Deputy  At- 
torney General,  might  be  summarized  with  the  following  quote: 

"My  general  conclusions  are  that  while  there  have  been 
no  proven  instances  of  vote  counting  fraud,  certain 
concerns  that  have  been  expressed  about  the  security 
and  accuracy  of  computerized  elections  appear  to  have 
validity.  However,  these  concerns  are  receiving  seri- 
ous attention  and  improvements  are  being  made.  A  prin- 
cipal concern  is  that  the  most  widely  used  vote  count- 
ing software  has  been  criticized  for  lacking  a  reliable 
audit  trail  and  having  a  program  structure  that  is  very 
difficult  even  for  computer  professionals  to  under- 
stand. 

"It  appears  that  most  of  the  reported  problems  associ- 
ated with  computerized  vote  counting  have  occurred  the 
first  time  the  system  is  used  by  local  election  offici- 
als, and  decrease  in  later  elections.  If  experience  is 
any  guide,  inaccuracies  in  tallying  election  results 
will  tend  to  diminish  as  local  election  officials  gain 
familiarity  with  electronic  systems,  but  the  potential 
for  fraud  may  tend  to  increase. 

"The  Attorney  General  should  urge  the  Secretary  of 
State  to  require  that  all  electronic  vote  tallying  sys- 
tems have  reliable,  tamper-proof  audit  trails."  [12] 

(Note:  compare  final  sentence  above  with  Strauss  quote  in  sec- 
tion 2.6  that  "...there  is  no  way  to  design  a  tamper-proof  pro- 
gram. If  prudent  procedures  are  not  followed  in  running  it,  any 
program  can  be  compromised"  [7].  It  would  seem  that  the  essen- 
tial need  is  for  "prudent  procedures.") 

The  Attorney  General's  report  was  publicized  by  the  San  Francisco 
Examiner  in  an  article  on  October  20,  1986.  The  article  reported 
that,    according  to  the  Secretary  of  State's  office,   which  regu- 
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lates  elections,  "in  25  years,  no  error  has  affected  the  outcome 
of  a  California  election."  However,  there  have  been  "sporadic 
glitches,"  the  article  reported.  Several  examples  were  given:  in 
San  Francisco  in  1983,  "an  electrical  power  fluctuation  during 
the  vote  count"  added  votes  incorrectly  to  one  candidate's  to- 
tals; in  Orange  County  in  198  0,  "a  computer  programmer's  mistake" 
gave  about  15,000  votes  meant  for  two  candidates  to  two  other 
candidates;  and  in  San  Joaquin  County  in  1984,  "a  misplaced  piece 
of  punch  card  caused  the  system  to  indicate  that  one  precinct  had 
not  been  counted  when  it  had  been."  [13] 

The  article  also  reported  that: 

"'Rigging  a  computer  vote  would  require  a  conspiracy  of 
six  to  eight  people, '  said  Deborah  Seller,  head  of  the 
state  secretary  of  state's  computer  voting  division. 
'The  greatest  possibility  of  error  that  I'm  aware  of  is 
human  error, '     she  said. 

"San  Francisco  Registrar  [Jay]  Patterson  said  that  many 
election  offices  depend  on  manufacturers  and  county 
data  processors  to  operate  the  systems.  'That  certain- 
ly is  not  the  best  of  situations  when  the  person  re- 
sponsible for  the  vote  count  is  not  actually  involved 
in  it, '  said  Patterson. 

"Some  counties  with  'sloppy  procedures'  have  failed  to 
test  computer  equipment  as  required  by  the  state,  ac- 
cording to  Robert  Naegele,  a  technical  consultant  to 
the  state  and  the  Federal  Election  Commission.  Each 
county  must  run  ' logic  and  accuracy  tests '  of  its  sys- 
tem before  and  after  the  vote  count."  [13] 

2 . 8  Texas  Controversy,  Hearings,   and  Legislation:  1986/1987 

2.8.1  Controversy  Over  1985  Dallas  Mayoralty  Contest 

Following  the  April,  1985,  Dallas  mayoralty  contest,  Ms.  Terry 
Elkins,  campaign  manager  for  losing  candidate  Max  Goldblatt,  ap- 
proached the  office  of  the  attorney  general  of  Texas  with  con- 
cerns about  the  manner  in  which  the  election  was  conducted.  The 
attorney  general's  office  asked  a  consultant  to  carry  out  an  in- 
vestigation. As  a  result  of  the  investigation,  Assistant  Attor- 
ney General  Robert  L.  Lemens  wrote  a  letter  to  Ms.  Karen  Glad- 
ney.  Director  of  Elections  for  Texas.  The  letter,  on  July  15, 
1986,   included  the  following  statement: 

"...although  [the  consultant]  has  insufficient  evidence 
to  conclude  that  fraud  has  been  committed,  the  elec- 
tronic voting  system  in  use  lacks  adequate  security 
features  to  provide  any  assurances  of  the  absence  of 
fraud.     As  a  result,  this  office  has  found  that  it  will 
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be  difficult  to  demonstrate  to  the  complainants  that 
Texas  elections  are  free  from  fraud  and,  thereby,  free 
local  election  officials  from  suspicion."  [14] 

Further  investigations  followed  by  both  the  office  of  the  attor- 
ney general  and  the  office  of  the  secretary  of  state  (the  latter 
included  Ms.  Gladney's  office).  On  September  23,  1986,  the  Dal- 
las Morning  News  reported  the  following  story: 

"The  state  attorney  general's  and  secretary  of  state's 
offices  are  investigating  discrepancies  found  in  the 
computerized  voting  records  of  several  recent  Dallas 
and  state  elections  to  determine  if  the  results  may 
have  been  obtained  fraudulently. . . 

"The  probe  centers  on  allegations  that  computerized 
voting  equipment  and  computer  programs  used  to  tabulate 
state  and  local  elections  may  have  been  tampered  with 
to  bring  about  'preprogrammed  results, '  [Attorney  Gen- 
eral Jim]  Mattox  said. . . . 

"Terry  Elkins,  who  managed  [Max]  Goldblatt's  [1985]  bid 
against  [incumbent  Mayor  of  Dallas  Starke]  Taylor,  said 
.  .  .  that  she  has  given  to  state  officials  18  months  of 
research  documenting  the  discrepancies  [in  the  1985 
mayor's  race].  Chief  among  the  discrepancies,  she  said 
is  a  claim  that  there  were  more  votes  cast  than  there 
were  voters'  signatures. 

"'The  allegation  is  that  the  computer  used  to  count  the 
votes  was  given  new  instructions  after  it  calculated 
that  Max  Goldblatt  was  leading  Starke  Taylor  by  400 
votes,'  Mrs.   Elkins  said."  [15] 

(Note:  A  detailed  discussion  of  vote-tallying  problems  in  the 
Dallas  1985  mayoralty  election  is  given  in  section  4.3.) 

The  following  day,  September  24,  1986,  the  Dallas  Times  Herald 
reported  this  additional  information: 

"[Attorney  General]  Mattox  said  [on  September  23]  that 
the  investigations  call  into  question  the  ability  of 
local  city  and  county  elections  officials  to  vouch  for 
the  integrity  of  their  elections  when  they  use  the 
automatic  vote-tallying  system. 

"The  punch  card  system,  which  uses  a  computer  to  count 
ballots  marked  by  voters,  is  so  complex  that  election 
fraud  could  go  unnoticed,  Mattox  said. 

" '  I  would  say  that  the  system  appears  not  to  have  the 
kind  of  safeguards  that  election  authorities  would  like 
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to  have  to  give  them  the  independent  capability  to 
judge  whether  there  has  been  fraud  in  an  election, '  he 
said. 

" '  It  would  not  be  easy  even   for  a  computer  expert  to 
determine  that  there  was  fraud,'  he  said."  [16] 

2.8.2  Texas  Secretary  of  State's  Directive 

As  a  result  of  the  uncertainties  created  by  the  charges  of  vote 
fraud,  and  the  ensuing  investigations,  the  Secretary  of  State  of 
Texas  issued  a  directive  on  October  14,  1986  detailing  additional 
security  procedures  for  computerized  vote-tallying  to  be  used  by 
county  clerks  and  election  administrators.  The  provisions  of  the 
directive  were  directly  responsive  to  identified  deficiencies  in 
vote-counting  procedures.     Some  of  the  provisions  are  as  follows: 

"Under  no  circumstances  may  the  computer-generated 
printed  log  of  computer  activity  that  occurs  during  the 
tabulation  be  turned  off.  The  log  must  record  all  op- 
erator commands  and  inputs  to  the  system  from  any  de- 
vice. The  log  must  indicate  for  each  precinct  the  to- 
tal number  of  ballots  that  are  entered  into  the  cen- 
tral computer. 

"Each  page  of  the  log  must  reflect  the  correct  time  of 
day. 

"Each    [of   at   least   three   cumulative   reports  produced 
t  throughout  the  tabulation  process]  shall  include  ...the 

number  of  over  votes  and  under  votes  in  each  race. 

"...  a  computer-generated  report  that  indicates  the 
number  of  ballots  cast  in  each  precinct  [shall  be  pre- 
pared] . 

"...  the  secretary  of  state  may  order  a  manual  count  of 
ballots  cast  in  the  election  to  ensure  the  accuracy  of 
the  count."  [17] 

2.8.3  Legislative  Hearings 

On  November  25,  1986,  the  Texas  House  of  Representatives  Commit- 
tee on  Elections,  chaired  by  Representative  Clint  Hackney,  held  a 
hearing  on  possible  changes  in  the  election  laws  of  Texas  related 
to  computerized  vote  tallying.  Statements  made  by  testifiers 
concerning  the  general  problems  of  computerized  voting  included 
the  following,  by  the  indicated  individuals: 

Dr.  Michael  Ian  Shamos,  computer  scientist,  and  one  of  three  sta- 
tutory examiners  of  electronic  voting  systems  for  the  Pennsyl- 
vania Bureau  of  Elections: 
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"Punched-card  systems  have  two  significant  positive 
features.  One  is  that  they  cause  a  permanent  physical 
record  to  be  kept  of  every  ballot  cast.... A  second 
positive  aspect  is  that  cards  can  be  counted  very  rap- 
idly. .  .  . 

"...punched-card  systems  have  no  other  redeeming  fea- 
tures and  in  fact  present  great  dangers.     These  are[:] 

"...the  ballot  itself  contains  no  candidate  names  and 
is  meaningless  when  examined.  This  problem  greatly 
increases  voter  confusion. . . . 

"The  voter  is  unable  to  determine  whether  he  has  cast  a 
complete  ballot  or  whether  he  may  have  voted  for  more 
candidates  that  he  is  entitled.  An  overvote  will  re- 
sult in  an  invalid  ballot,  and  the  voter's  legitimate 
choices  will  go  uncounted. . . . 

"It  is  a  straightforward  matter  to  alter  a  punched-card 
voting  booth  so  that  votes  cast  for  one  candidate  will 
be  recorded  as  though  they  were  for  another. . . .Any  re- 
quired tampering  can  be  performed  during  the  election 
and  all  traces  removed  before  any  investigation  can  oc- 
cur. .  .  . 

"....the  computer  hardware  and  software  used  to  tabu- 
late the  ballots  is  subject  to  tampering.  Furthermore, 
such  tampering  is  relatively  easy  and  invisible. ...  Com- 
puters can  be  manipulated  remotely,  by  wire  or  radio, 
or  by  direct  physical  input.  The  memories  on  which 
these  computers  operate  can  easily  fit  into  a  shirt 
pocket  and  can  be  substituted  in  seconds.  The  software 
can  be  set  to  await  the  receipt  of  a  special  card, 
whose  presence  will  cause  all  the  election  counters  to 
be  altered.  This  card  could  be  dropped  into  the  ballot 
box  by  any  confederate.  The  possibilities  for  this 
type  of  tampering  are  endless,  and  virtually  no  detec- 
tion is  possible  once  tabulation  has  been  completed. . . . 

"Even  if  the  software  is  not  altered,  there  is  no  rea- 
son to  believe  that  it  is  correct.  Many  tests  per- 
formed on  such  programs  have  revealed  faulty  logic  and 
wildly  incorrect  results....  Many  jurisdictions,  such 
as  Pennsylvania,  have  complex  rules  for  counting  such 
situations  as  cross-filed  candidates  in  vote-f or-many 
offices  and  it  is  stretching  to  believe  that  an  elec- 
tion system  vendor  would  be  aware  of  all  such  combina- 
tions of  conditions  to  have  produced  perfect  software. 
It  is  axiomatic  in  the  computer  industry  that  all  large 
computer  programs   contain  errors,    and  the  more  exten- 
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sive  the  software  the  more  errors  it  contains. . . . 

"When  one  company  or  a  conglomerate  of  companies  supply 
unauditable  software  from  a  central  distribution  point, 
or  participate  directly  in  ballot  setup  procedures, 
there  exists  the  possibility  of  large-scale  tampering 
with  elections.  An  errant  programmer  or  tainted  execu- 
tive could  influence  or  determine  the  outcome  of  a  ma- 
jority of  election  precincts  in  the  country...."  [18] 

Ms.  Suzan  N.  Kesim,  vice-president  of  a  security  consulting  firm 
of  South  Bend,  Indiana: 

"The  program  for  counting  elections  should  use  struc- 
tured programming  techniques.  A  detailed  flow  chart  of 
the  program  should  be  required  [to  be  submitted] .... 

"Whether  you  are  adding  dollars  or  votes,  you  can  apply 
many  of  the  same  auditing  standards....  Many  of  the 
computer  auditing  procedures  used  by  the  banking  indus- 
try that  have  been  tried  and  true  could  easily  be  modi- 
fied or  used  as  they  are  for  auditing  elections.... 

"Pre-punching  the  ballots  with  the  precinct  could  be  a 
really  crucial  way  of  checking  and  making  sure  that 
ballots  don't  slide  from  precinct  to  precinct.... 

"Fraud  possibilities  include   'hidden  programs'.... 

"Write  a  public  domain  software  program  to  count  votes, 
open  to  public  scrutiny...."  [19] 

Anita  Rodeheaver,   County  Clerk,  Harris  County  (Houston) ,  Texas: 

"A  computer,  whether  it  is  in  a  bank  or  a  hospital  or  a 
collection  agency,  or  being  used  for  elections,  is  only 
as  good  as  the  people  that  run  it.... 

"It  upsets  me  when  continually  we  work  so  hard  to  have 
good  honest  elections  and  we  continually  get  hit  with 
things  that  could  happen  or  'supposedly  are  happening,' 
but  no  one  ever  comes  up  with  any  concrete  evidence 
that  they  did  happen...."  [20] 

Tom  Eschberger,  Vice-President  of  Business  Records  Corp. : 

"In  twenty  years,  I  have  seen  two  cases  of  attempted 
fraud  on  an  election  system.  I  saw  one  in  Albuquerque, 
New  Mexico  on  lever  machines,  and  one  in  Pueblo,  Colo- 
rado attempted  on  punch  cards.  I  have  personally  run 
about  one  thousand  elections  around  the  country. ... 
Those   were    the    only   two   cases   where   I   was  convinced 
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that  somebody  had  tried  to  defraud  somebody. 

"I  have  seen  a  lot  of  cases  where  people  make  dumb  mis- 
takes, where  the  totals  don't  add  up....  Elections  are 
run  by  amateurs.  [Other  than  experienced  election  ad- 
ministrators,] there  are  400  people  out  in  the  pre- 
cincts who  got  just  a  one-hour  training  class.  People 
are  not  going  to  have  perfect  elections.  People  are 
going  to  have  the  best  elections  that  well-intentioned 
honest  people  can  run,  and  that  well-intentioned  honest 
companies  can  run. . . . 

"A  lot  of  counties  want  us  to  do  the  programming  for 
them  because  it  disassociates  them  from  any  candidate 
and  any  accusation  of  fraud  or  collusion. . . .  [Persons 
intending  to  commit  fraud  would]  have  to  have  our 
source  code,  they  would  would  have  to  have  collusion 
with  somebody  in  the  county,  they  would  have  to  have 
access  to  the  computer. . . . 

"[Filing  the  program  with  the  secretary  of  state]  might 
set  some  minds  at  ease.  Then,  someone  could  look  at 
the  code  and  know  what's  going  on  in  an  election  if 
there  were  a  problem.  If  someone  said  there  was  fraud 
and  here's  how  they  did  it,  then  you  have  someone  at 
the  State  level  who  is  familiar  with  our  source  code 
that  could  say  yes  or  no.  Yes,  it  would  be  beneficial 
from  that  standpoint."  [21] 

Warner  Croft,  a  partner  in  the  public  accounting  firm  of  Arthur 
Anderson  and  Company: 

"We  do  believe  the  election  laws  need  to  be  codified  to 
reflect  the  technology  being  employed  today  in  the 
election  process. 

"We  do  believe  that  the  Secretary  of  State  needs  to 
have  the  authority  and  the  money  to  enforce  those  laws, 
to  make  sure  that  the  proper  audit  trails  are  in  place, 
so  that  whenever  allegations  do  surface,  .  .  .  the  rec- 
ords are  in  place  so  that  the  State  can,  with  a  minimum 
of  time  and  effort,  go  to  those  records  and  find  out 
what  happened. 

"Unfortunately,    the    laws    at   this    time   are    a   bit  too 
nebulous  for  that  to  be  done. . . . 

"As  long  as  there  are  winners  and  losers  in  elections, 
regardless  of  the  system  being  used,  there  will  be 
these  allegations.  You  cannot  legislate  this  problem 
away  by  requiring  a  higher  generation  of  technology, 
another  language. 
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"But  what  we  can  do  is  require  an  audit  trail,  so  that 
the  documents  that  represent  the  voter's  intent  are 
kept  on  file,  for  a  predefined  minimum  period  of  time, 
so  that  no  matter  what  went  on  inside  the  computer, 
we've  got  a  source  that  we  can  go  back  to,  to  determine 
what  the  voter  actually  did...."  [22] 

2.8.4  Revised  Texas  Statute  on  Electronic  Voting  Systems 

A  revised  statute  on  the  use  of  electronic  voting  systems  was 
passed  by  the  Texas  legislature  and  was  approved  in  June,  1987 
[23].  It  took  effect  on  September  1  of  that  year.  Some  of  the 
revisions  concerned  the  following  topics: 

Auditing:  A  voting  system  may  not  be  used  unless  it  is  capable 
of  providing  records  from  which  the  operation  of  the  system  may 
be  audited. 

Deposit  and  Comparison  of  the  Program:  Copies  of  the  "program 
codes"  and  related  documentation  must  be  filed  with  the  secretary 
of  state.  The  secretary  of  state  must  periodically  compare  the 
materials  on  file  with  those  materials  actually  used  to  ensure 
that  only  approved  materials  are  used.  The  software  on  file  is 
not  public  information,  although  it  may  be  made  available  to  the 
attorney  general  for  investigation  of  irregularities. 

Use  of  Remote  Terminals:  Computer  terminals  located  outside  the 
central  counting  station  must  be  capable  of  "inquiry  functions 
only"  during  vote  tabulation,  and  "no  modem  access  to  the  tabula- 
tion equipment"  must  be  available  during  tabulation. 

Testing  of  Equipment:  Each  unit  of  tabulating  equipment  shall  be 
tested  "using  all  applicable  ballot  formats." 

Discrepancies  in  Ballot  Totals:  If,  in  the  use  of  a  precinct- 
located  computer,  a  discrepancy  of  more  than  three  exists  between 
the  number  of  ballots  recorded  by  the  computer  and  the  number  of 
ballots  written  down  by  the  precinct  officials,  the  final  count 
of  that  precinct  shall  be  done  centrally. 

Manual  Count;  A  manual  count  of  all  the  races  in  one  percent  of 
the  election  precincts,  but  in  no  less  than  three  precincts, 
shall  be  conducted  at  the  local  level.  The  secretary  of  state 
also  may  conduct  a  manual  or  automatic  count  of  any  number  of 
ballots.  No  specific  ground  for  obtaining  an  initial  recount  is 
required. 

As  a  result  of  passage  of  the  revised  statute,  all  electronic 
voting  systems  now  certified  for  use  in  Texas  will  need  to  be  re- 
certified. The  revised  statute  specifically  addresses  some  of 
the  problems  of  computerized  vote-tallying  identified  immediately 
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below. 


2 . 9  Current  Problems  Of  Computerized  Vote-Tallying 

Current  problems  of  computerized  vote-tallying,  including  those 
identified  by  those  who  have  recently  made  public  statements  or 
produced  public  documents,  are  summarized  by  the  following  cate- 
gorizations. The  relationship  of  the  recommendations  of  this 
report  to  these  problems  is  discussed  in  section  6.18. 

2.9.1  Difficulty  in  Verifying  Results 

Results  of  elections  announced  by  election  officials  are  diffi- 
cult to  verify.     The  problem  of  verifying  results  is  due  to: 

(a)  lack  of  audit  trails; 

(b)  poor  design  of  computer  programs; 

(c)  vendor-supplied  computer  programs  that  are  unavailable 
to  the  scrutiny  of  responsible  officials; 

(d)  administrative  procedures  that  are  incomplete  and  poorly 
implemented,  resulting,  for  example,  in  the  inability  of  obser- 
vers to  successfully  compare  computer  reports  of  ballots  cast 
with  the  same  data  reported  by  precinct  officials. 

2.9.2  Possibility  of  Undiscoverable  Frauds 

The  lack  of  internal  controls  and  failure  to  implement  computer 
security  increase  the  possibilities  that  unknown  persons  may 
perpetrate  undiscoverable  frauds.  Methods  of  forcing  incorrect 
results  include: 

(a)  fraudulent  alterations  in  the  computer  program  or  in 
control  cards  that  manipulate  the  program; 

(b)  activation  of  a  hidden  program,  possibly  by  means  of  a 
time-of-day  match  or  with  a  specially  encoded  punch  card  ballot; 

(c)  manual  replacement  of  the  computer  program  by  a  fraudu- 
lent substitute; 

(d)  introduction  of  false  ballots  into  the  set  of  real  bal- 
lots, through  either  addition  or  replacement;  or  introduction  of 
false  ballot  data  through  interchange  of  ballots,  by  a  perpe- 
trator taking  advantage  of  different  ballot  styles; 

(e)  introduction  of  false  voting  summaries  through  changes 
in  data  stored  in  removable  data  storage  units  of  precinct-lo- 
cated, vote-counting  devices; 

(f)  fraudulent  alteration  of  the  face  of  the  voting  device 
used  by  the  voter  at  the  polling  location  to  mark  a  ballot  or 
indicate  choices; 

(g)  fraudulent  alteration  of  the  logic  of  precinct-located, 
vote-counting  devices. 
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2.9.3  Election  Administrators'  Lack  of  Knowledge  and  Resources 

Some  election  administrators  have  a  lack  of  knowledge  about  com- 
puters, and  they  lack  the  necessary  knowledge  and  resources  to 
effectively  negotiate  with  vendors.  The  effect  of  these  defi- 
ciencies are: 

(a)  administrative  errors  in  conducting  elections,  with  in- 
creased potential  for  fraud  or,  at  minimum,  loss  of  public  confi- 
dence ; 

(b)  abdication  of  control  over  elections  to  vendors  and 
county  data  processors,  with  the  resultant  inability  to  impose 
the  necessary  internal  controls; 

(c)  inability  to  require  vendors  to  provide  computer  pro- 
grams, election  equipment  and  supplies  that  include  adequate 
safeguards  against  fraud  and  inaccurate  reporting; 

(d)  increased  risk  to  vendors  in  entering  a  market  fraught 
with  the  potential  for  negative  publicity,  resulting  in  reduced 
competition  and  reduced  investment  in  improved  products; 

(e)  slower  than  adequate  introduction  of  more  effective 
technology. 
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3.  TYPES  OF  VOTE-TAT.T.YTWG  SYSTEMS.  THEIR  VULNERABILITIES.  AND 
THEIR  NATIONAL  DISTRIBUTION 

3 . 1  Vote-Tallvinq  As  Part  Of  Voting 

Voting,  as  it  is  carried  out  in  the  United  States  today,  may  be 
said  to  consist  of  four  distinct  administrative  steps.  These 
are: 

(1)  voter  authorization:  the  determination  of  whether  the 
prospective  voter  is  entitled  to  vote  at  a  particular  place,  and 
for  what  set  of  offices  and  issues; 

(2)  secret  choice:  provision  of  the  opportunity  for  the 
voter  to  express  his  or  her  choices  without  intimidation: 

(3)  precise  recording  of  the  expression  of  each  voter's 
choices  in  a  voter-disconnected  and  easily  countable  format;  and 

(4)  accurate  summarization  of  all  voters'  choices  by  candi- 
date and  issue  alternative. 

Vote-tallying,  a  subset  of  voting,  consists  of  steps  (3)  and  (4) , 
although  the  process  involves  concern  for  steps  (1)   and  (2) . 

3 . 2  Paper  Ballots 

The  uniform  use  of  an  official  ballot  containing  the  names  of  all 
candidates,  printed  on  uniform  paper  by  public  officers  at  public 
expense,  and  distributed  only  at  the  polls  where  it  is  marked  in 
secret,  was  adopted  first  in  the  Australian  state  of  Victoria  in 
1856.  In  the  years  immediately  following,  the  concept  was  adopt- 
ed in  other  Australian  states.  Thus,  it  came  to  be  called  the 
"Australian  ballot"  [24].  The  Australian  ballot  concept  was  the 
first  successful  attempt  to  meet  the  requirements  of  steps  (2) 
and  ( 3 )  above . 

The  Australian  ballot  had  its  first  U.S.  statewide  application  in 
New  York  in  1889,  and  was  adopted  widely  throughout  the  Nation  in 
the  next  decades.  Prior  to  that,  the  application  of  the  secret 
ballot  was  limited.  In  many  cases,  persons  had  to  announce  their 
votes  publicly,  or  tell  them  to  a  sheriff  who  recorded  them.  In 
other  cases,  there  were  party-specific  paper  ballots,  produced 
with  different  colors  or  weights  of  paper  to  reveal  party  choice. 

During  the  early  years  of  introduction  of  the  Australian  ballot, 
there  was  considerable  controversy  over  whether  the  information 
on  the  ballots  should  be  arranged  in  a  "party"  format  (the  set  of 
all  candidates  of  a  single  party  listed  together) ,  or  in  an  "of- 
fice" format  (the  set  of  all  candidates  for  a  single  office  list- 
ed together) .  At  present,  most  ballots  are  designed  with  an 
"office"  format.  However,  in  many  states,  voters  are  permitted 
to  select  all  candidates  of  a  particular  party  with  a  single 
"straight  party"  vote,  with  an  allowance  for  "crossover"  votes 
for  specific  candidates  of  any  other  party. 
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Paper  ballots  remain  in  use  today  in  small  communities  and  rural 
areas  by  about  eleven  percent  of  U.S.  registered  voters  (see  sec- 
tion 3.9.2  for  the  percentage  of  use  of  the  various  system  types 
by  counties  and  by  registered  voters) . 

3.2.1  Vulnerabilities  of  Paper  Ballots 

When  effective  administrative  controls  are  not  applied,  paper 
ballots  are  subject  to  possible  fraud  and  error  in  their  distri- 
bution, in  their  use  at  polling  places,  and  in  counting. 

Ballot  frauds:  Failure  to  properly  account  for  ballots  distri- 
buted may  provide  the  opportunity  for  fraudulent  addition  of  ex- 
tra ballots  into  the  ballot  box,  an  activity  generally  referred 
to  as  "ballot  stuffing."  In  places  where  votes  are  bought  and 
real  ballots  are  not  sufficiently  distinctive,  voters  may  be 
handed  pre-voted  counterfeit  ballots  before  entering  the  polling 
place.  As  an  alternative  fraud,  voted  counterfeit  ballots  may 
be  substituted  for  real  ballots  already  voted. 

Chain  voting;  When  administrative  controls  at  the  polling  loca- 
tion are  poorly  implemented,  and  enough  voters  are  willing,  chain 
voting  is  a  possibility.  In  chain  voting,  the  first  voter  in  the 
chain  retains  the  unvoted  ballot  given  to  him  at  the  polling 
place  and,  instead  of  voting,  takes  the  ballot  outside.  This 
voter  loses  his  vote,  but  starts  the  chain.  Outside,  a  party 
worker  fills  out  the  ballot  and  hands  it  to  a  second  voter  who 
has  also  agreed  to  participate.  The  second  voter  turns  in  the 
voted  ballot,  but  retains  the  unvoted  ballot  handed  to  him  in  the 
polling  place  for  return  to  the  party  worker  outside.  Successive 
voters  who  participate  receive  a  pre-voted  ballot  and  return  an 
unvoted  ballot  to  the  party  worker. 

Malicious  invalidation:  In  counting  paper  ballots,  extra  marks 
may  be  made  on  ballots  intended  for  an  opposition  candidate, 
thereby  subjecting  those  ballots  to  invalidation  in  jurisdictions 
where  extra  marks  are  cause  for  that  result.  (Extra  marks  are 
often  cause  for  invalidation  because  such  marks  may  be  used  to 
indicate  that  a  private  agreement  has  been  carried  out  in  which  a 
voter  has  agreed  to  vote  as  instructed  in  return  for  some  consid- 
eration.) 

Inaccurate  counting:  Hand  counting  of  large  numbers  of  paper 
ballots  is  generally  inaccurate,  because  of  human  inattention  and 
fatigue,  compared  with  counting  of  machine-readable  ballots. 

3 . 3  Lever  Machines 

The  first  use  of  mechanical  lever-type  voting  machines  was  in 
Lockport,  New  York  in  1892  [25].  In  the  use  of  these  types  of 
machines,   hereinafter  referred  to  as  "lever  machines,"  each  can- 
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didate  or  issue  alternative  is  assigned  a  particular  lever  of  a 
rectangular  array  of  levers  on  the  face  of  the  machine  that  is 
seen  by  the  voter.  The  levers  are  horizontal  in  their  unvoted 
positions.  The  array  of  levers  may  be  arranged  with  offices  from 
right-to-left  and  parties  from  top-to-bottom,  or  vice-versa.  A 
set  of  inserted  printed  strips  visible  to  the  voter  identifies 
the  lever  assignments. 

On  entering  the  area  of  the  machine  (the  "voting  booth")  ,  the 
voter  enables  the  machine  with  a  handle  that  also  closes  a  pri- 
vacy curtain.  Then,  in  order  to  indicate  choices,  the  voter 
pulls  down  selected  levers.  When  the  voter  exits  the  voting 
booth  by  opening  the  privacy  curtain  with  the  handle,  the  levers 
are  automatically  returned  to  their  original  positions.  As  each 
lever  returns,  it  causes  a  connected  counter  wheel  within  the  ma- 
chine to  turn  one-tenth  of  a  full  rotation.  The  counter  wheel, 
serving  as  the  "units"  position  of  the  numerical  vote  count  for 
the  associated  lever,  drives  a  "tens"  counter  one-tenth  of  a  ro- 
tation for  each  of  its  full  rotations.  The  "tens"  counter  simi- 
larly drives  a  "hundreds"  counter.  If  all  the  mechanical  connec- 
tions are  fully  operational  during  the  voting  period,  and  the 
counters  are  initially  set  to  zero,  the  position  of  each  counter 
at  the  end  of  the  voting  period  indicates  the  number  of  votes 
that  were  cast  on  the  lever  that  drives  it. 

By  1930,  lever  machines  had  been  installed  in  Denver,  Milwaukee, 
Minneapolis,  Newark,  New  York  City,  Pittsburgh,  Philadelphia,  and 
San  Francisco  [26].  One  reason  for  the  acceptance  of  the  ma- 
chines was  the  existence  of  significant  fraud  in  the  use  of  paper 
ballots.  By  the  middle  1960s,  just  before  the  introduction  of 
punch  card  voting,  almost  all  large  cities  and  many  medium-sized 
ones  used  lever  machines.  It  is  likely  that,  at  that  time,  over 
one-half  the  votes  in  the  Nation  were  being  cast  on  lever  ma- 
chines (now  slightly  more  than  one-third) . 

Lever  machines  are  precinct-located  devices,  that  is,  the  basic 
vote-count  is  accomplished  at  a  neighborhood  voting  location  that 
may  be  remote  from  the  place  where  the  votes  are  summarized  to 
determine  the  outcomes  of  the  contests.  The  number  of  machines 
at  each  location  depends  on  the  number  of  persons  expected  to 
vote  there  and  the  expected  average  time  for  a  person  to  cast  a 
complete  set  of  votes.  Separate  machines  may  be  required  for 
each  party  in  a  primary  election  (conceivably,  only  part  of  the 
machine  could  be  made  operable  for  a  voter  of  a  specific  party, 
with  another  part  reserved  for  another  party)  and  for  each  pre- 
cinct voting  at  the  same  location. 

3.3.1  Summarizing  Lever  Machine  Results 

After  the  close  of  the  polls,  the  backs  of  the  machines  are  open- 
ed. The  number  of  votes  is  read  off  each  of  the  counters,  and 
each  number  is  transcribed  to  official  documents.     Recently  manu- 
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factured  lever  machines  may  allow  for  printing  of  the  counter 
values  on  request.  The  official  precinct  documents  are  carried 
to  the  central  vote-counting  location  for  summarization. 

With  lever  machines,  only  summarized  voting  results  are  available 
at  the  precinct  level.  No  individual  choices  are  available  to  be 
counted.  Interlocks  in  the  machines  prevent  overvoting  (voting 
for  more  than  the  allowed  number  of  candidates  in  a  contest, 
e.g.,  voting  for  three  candidates  in  a  vote-for-two  contest,  such 
as  for  school  board)  .  There  can  be  undervotes  (voting  for  less 
than  the  allowed  number  of  candidates  in  a  contest,  e.g.,  voting 
for  one  or  no  candidate  in  a  vote-for-two  situation) . 

3.3.2  Vulnerabilities  of  Lever  Machines 

With  a  lever  machine,  there  is  no  ballot,  i.e.,  no  independent 
verification  of  each  machine's  recorded  result.  While  the  lack 
of  ballots  eliminates  the  possibility  of  chain  voting,  counter- 
feit ballots,  and  spoiling  of  the  opponent's  ballots,  there  are 
other  possibilities  for  fraud  or  error,  some  available  because 
there  are  no  ballots. 

Vote  count  frauds:  The  lever-machine  equivalent  to  "ballot  stuf- 
fing" is  the  casting  of  extra  votes  on  the  machine  by  party  work- 
ers. When  there  is  no  genuine  bipartisan  staffing  of  a  precinct 
polling  place,  any  type  of  vote-tallying  system  is  more  easily 
subjected  to  fraud. 

No  audit  trail  of  voter's  intent;  One  effect  of  the  unavailabil- 
ity of  ballots  is  the  lack  of  a  true  audit  trail.  No  unequivocal 
distinction  between  an  undervote  and  a  machine  failure  can  be 
made  solely  with  a  review  of  the  vote  counts.  If  the  number  of 
votes  cast  for  an  office  is  less  than  the  number  of  persons  that 
have  voted  on  the  machine  (often  indicated  by  a  "public  counter" 
that  may  be  connected  to  the  voting  handle) ,  then  for  each  under- 
vote, there  are  the  following  possibilities  for  a  contest  involv- 
ing two  candidates:  either  the  voter  failed  to  vote  for  either 
candidate,  or  the  counter  mechanism  failed  to  turn  for  the  vot- 
er's choice. 

In  general,  it  is  not  possible  to  determine  which  one  of  these 
possibilities  is  the  correct  one  for  any  single  undervote  without 
a  review  of  the  internal  condition  of  the  machine.  If  a  counter 
mechanism  failed  to  turn,  it  may  be  due  to  an  actual  disconnect 
in  the  mechanical  system,  or  it  may  be  due  to  excessive  friction 
in  the  connections.  If  a  vote  total  reads  000  or  some  number  up 
to  C09  when  many  more  might  have  been  expected,  a  mechanical  dis- 
connect is  a  strong  possibility.  If  a  vote  total  reads  009  or 
099,  the  possibility  is  increased  that  excessive  friction  at  the 
point  of  highest  mechanical  resistance  to  turning  (during  an 
arithmetic  carry  operation)  caused  a  failure.  If  the  counter 
failed  to  turn  correctly  for  any  reason,   there  is  no  independent 


28 


ballot  available  to  verify  the  count.  The  voter's  choices  are 
lost,  absent  a  court  order  for  a  new  election. 

No  true  recount  capability;  In  a  lever  machine  contest,  a  "re- 
count" simply  means  that  the  precinct  transcriptions  are  reviewed 
to  determine  if  any  precinct  official  erred  in  copying  down  the 
counter  values  or  the  precinct  documents  were  fraudulently  re- 
placed on  the  way  to  the  central  summarization  location. 

Write-in  difficulty:  Another  problem  with  lever  machines  is  the 
difficulty  of  indicating  write-in  votes.  The  lever  machine  is 
not  oriented  towards  individual  idiosyncratic  choice,  but  only 
choice  from  the  available  menu.  If  State  or  local  law  requires 
it,  a  roll  of  paper  is  made  available  with  the  machine  for  use  by 
a  voter  in  writing  a  name  not  available  on  a  lever.  However,  the 
selection  and  use  of  this  mechanism  is  noisy,  and  it  is  obvious 
to  those  around  the  voting  area  that  a  write-in  vote  is  in  prog- 
ress. Since  only  a  small  number  of  voters  may  choose  this  possi- 
bility, privacy  may  be  completely  lost  by  those  individuals  in 
that  instance. 

Mis-labeling:  A  possibility  for  error  or  deliberate  fraud  is  the 
insertion  of  incorrect  identifying  strips  on  the  front  of  the 
machine,   so  that  the  levers  are  mis-identified  to  the  voters. 

Storage  and  transport:  Lever  machines  are  large  and  heavy,  and 
therefore  difficult  to  transport  and  expensive  to  store  (compared 
with  precinct-located  electronic  machines) . 

Setup  errors  or  frauds:  "Programming,"  i.e.,  pre-election  setup 
with  interlocks,  requires  specialized  knowledge  and  is  labor- 
intensive.  Furthermore,  the  necessary  specialized  knowledge  is 
not  directly  translatable  to  a  variety  of  other  work,  for  the 
support  of  the  machine  technicians  between  elections.  As  with 
any  other  situation  where  specialized  knowledge  may  be  employed 
for  honest  or  dishonest  purposes,  the  possibility  of  collusion 
involving  lever-machine  "programmers"  must  be  considered. 

Difficultv  in  operabilitv  verification:  It  is  difficult  to  sta- 
tistically test  the  correct  operation  of  a  lever  machine  by  ap- 
plying a  large  number  of  test  votes.  A  lever  machine  is  operated 
by  direct  human  action,  and  the  use  of  human  labor  to  insert  a 
statistically  significant  number  of  test  votes  to  each  counter 
would  be  expensive  and  error-prone.  To  effectively  accomplish  a 
statistical  test  of  correct  operation,  a  mechanism  would  need  to 
be  constructed  that  could  vote  on  each  lever  a  large  number  of 
times  with  an  electromechanical  drive  that  could  be  programmed. 
The  mechanism  would  check  the  following:  the  single-vote  record- 
ing operation  of  each  counter,  proper  implementation  of  vote-for- 
more-than-one  setups,  overvote  prevention,  and  proper  operation 
of  the  arithmetic  carry  mechanism. 
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3 . 4  Punch  Card  Voting 


Voting  systems  based  on  punch  card  ballots  began  to  be  used  in 
the  middle  1960s,  and  received  considerable  application  in  the 
western  part  of  the  U.S.  by  1972.  At  that  time,  about  10%  of 
U.S.  voters  used  punch  card  ballots  to  record  their  choices  [27] 
(but  now,  almost  45%  use  one  of  the  two  principal  types  of 
cards) . 

The  introduction  of  punch  card  voting  was  an  economic  choice  of 
many  communities  in  their  efforts  to  provide  election  services  to 
an  expanding  population.  Voting  with  punch  cards  does  not  re- 
quire serial  processing  of  many  voters  through  a  single  voting 
station  containing  a  complex  machine.  Several  voting  stations 
may  be  made  available  in  one  precinct  with  much  less  expense. 

In  the  late  1960s  and  1970s,  punch  card  input  of  data  to  main- 
frame computers  was  commonplace.  Punch  card  stock  and  punch 
card  reader  technology  were  widely  available.  American  national 
standards,  developed  to  specify  the  size  of  the  cards  [28]  and 
the  arrangement  of  holes  in  each  card  [29],  were  available  to  be 
adopted  for  punch  cards  used  in  voting. 

The  standard  punch  card  has  960  potential  punch  locations  ar- 
ranged in  80  columns  by  12  rows.  In  common  business  use,  each 
column  on  a  card  represents  one  character  (such  as  a  letter  of 
the  alphabet  or  decimal  digit)  .  A  standard  data  code  for  busi- 
ness use  of  the  punch  card  has  been  developed,  and  it  is  called 
the  Hollerith  code  [30].  In  this  code  and  in  its  recent  exten- 
sions, a  graphic  character  (a  character  seen  in  printed  text) 
typically  requires  no  more  than  three  holes  in  a  column  to  repre- 
sent it.  For  each  unique  character,  the  holes  representing  it 
form  a  correspondingly  unique  pattern.  When  the  pattern  of  holes 
in  the  twelve  locations  in  one  column  is  read  by  a  card  reader 
and  converted  to  a  sequence  of  Is  and  Os  in  a  computer  (e.g.,  1 
for  a  hole  and  0  for  no  hole)  ,  the  sequence  may  be  recognized  as 
the  unique  character  by  a  computer  program. 

When  the  standard  punch  card  is  to  be  used  to  record  votes,  it  is 
necessary  to  permit  more  variability  in  the  use  of  punch  loca- 
tions than  the  Hollerith  coding  system  allows.  When  any  number 
and  arrangement  of  holes  in  a  single  column  are  permitted,  the 
coding  system  is  called  "column  binary."  However,  not  every  lo- 
cation on  the  card  can  be  used  for  voting.  This  restriction  is 
generally  due  to  ballot  layout  considerations,  but  some  consider- 
ation must  be  given  to  the  physical  strength  of  the  card  when  it 
is  used  with  more  intensive  layouts.  A  further  limitation  on 
the  use  of  punch  locations  is  necessary  if  information  about  the 
candidates  and  issue  choices  is  to  be  printed  on  the  card. 
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3.4.1  Vulnerabilities  of  Punch  Card  Use 

Punch  card  ballots  have  all  of  the  vulnerabilities  of  paper  bal- 
lots that  are  related  to  distribution,  precinct  use,  and  collec- 
tion. Administrative  controls  may  be  implemented  to  prevent  the 
typical  paper  ballot  frauds.  Most  of  these  controls  have  been 
previously  identified  [1],  and  are  proposed  again  in  section 
6. 16. 

Manufacturing  recmirements :  Accurate  dimensioning  in  manufactur- 
ing, and  use  of  materials  consistent  with  the  needs  of  punch  card 
readers,  are  additional  requirements  unnecessary  for  paper  bal- 
lots. 

Ballot-reader  requirements:  Accurate  ballot  reading  is  of  funda- 
mental importance  in  a  punch  card  system.  Assurance  should  be 
obtained,  in  both  pre-election  and  post-election  checkout,  that 
the  readers  are  correctly  reading  the  ballots.  In  addition  to 
the  question  of  accurate  recording  of  voters'  selections,  dif- 
ficulties in  ballot  processing  may  include  card  jams,  transport 
of  more  than  one  ballot  at  a  time,  and  the  inherent  problem  of 
pre-scored  cards.  If  a  card  jams  in  the  reader,  it  is  essential 
to  know  whether  or  not  the  card  was  counted;  otherwise,  either 
the  card  and  its  votes  may  be  counted  twice,  or  not  at  all. 
Transport  of  more  than  one  ballot,  similarly,  may  cause  a  mis- 
count of  the  cards  as  well  as  inaccurate  reading.  (The  reader 
can  accurately  read  only  one  ballot  at  a  time.)  The  problem  of 
pre-scored  cards  is  considered  in  sections  3.4.3  and  3.4.4. 

3.4.2  Types  of  Punch  Cards 

Two  common  types  of  punch  cards  used  for  voting  may  be  distin- 
guished. These  are  designated  in  popular  usage  as  the  "votomat- 
ic"  card  type  and  the  "datavote"  card  type.  As  used  by  a  voter, 
a  card  of  either  type  is  positioned  with  the  long  edges  on  the 
right  and  left,  and  the  short  edges  at  the  top  and  bottom.  Thus, 
each  column  is  horizontal,  and  each  row  is  vertical.  The  card  is 
usually  issued  to  the  voter  with  a  numbered  stub  attached  to  the 
top  short  edge.  The  line  of  attachment  is  perforated  for  easy 
removal  of  the  stub.  In  most  cases,  the  stub  is  removed  immedi- 
ately before  the  ballot  is  submitted;  it  may  be  removed  by  a  pre- 
cinct official  while  the  voter's  choices  are  covered  by  an  enve- 
lope or  other  holder.  One  use  of  the  number  on  the  stub  is  to 
assure  that  the  ballot  voted  is  the  same  one  issued  to  the  voter. 

"Votomatic"  card:  With  the  "votomatic"  card,  the  locations  at 
which  holes  may  be  made  to  indicate  votes  are  assigned  numbers. 
The  number  of  each  hole  is  the  only  information  printed  on  the 
card.  This  type  of  card  maximizes  the  number  of  voting  locations 
available.  As  there  is  no  space  on  the  card  for  names,  names  of 
write-in  candidates  must  be  written  by  the  voter  on  the  envelope 
provided  to  the  voter  with  the  card.      In  the  tallying  process, 


31 


each  envelope  must  be  examined  before  the  card  is  removed;  each 
card  and  its  envelope  with  write-ins  must  be  put  aside  for  sepa- 
rate processing.  The  envelopes  with  write-ins  cannot  be  separat- 
ed from  their  ballot  cards  until  the  cards  are  reviewed  for  over- 
votes. 

In  the  312-position  "votomatic"  card,  every  third  column  is  used, 
beginning  with  column  5  and  ending  with  column  80.  This  allows 
for  26  usable  columns  which,  when  combined  with  12  rows  per  col- 
umn, provides  for  312  positions.  There  are  also  228-position  and 
2  3  5-position  cards  available.  Only  one  side  of  the  "votomatic" 
card  is  used.  The  "votomatic"  card  (when  separated  from  any  at- 
tached stub)  is  generic  for  any  election,  as  it  only  has  numbers 
on  it. 

"Datavote"  card;  With  the  "datavote"  card,  the  name  of  the  can- 
didate or  description  of  the  issue  choice  is  printed  on  the  card 
next  to  the  location  at  which  the  hole  is  to  be  punched  to  indi- 
cate the  choice.  Fewer  voting  locations  are  available  on  the 
"datavote"  card.  However,  the  "datavote"  card  provides  a  partic- 
ularly simple  write-in  capability,  as  a  separate  blank  candidate 
line  in  each  contest  may  be  provided  for  that  purpose. 

For  the  "datavote"  type  card,  the  locations  used  for  voting  are 
in  a  row  close  to  the  righthand  long  edge  of  the  card.  Spacing 
of  two  or  more  columns  between  voting  locations  is  required  to 
allow  room  for  the  printing  of  the  candidate  name  or  issue  choice 
description.  Typically,  the  card  may  be  turned  over  (with  its 
long  dimension  as  an  axis)  so  that  the  other  long  edge  is  on  the 
right.  Then,  the  other  side  of  the  card  and  a  row  close  to  the 
second  long  edge  may  also  be  used  to  provide  voting  locations. 

3.4.3  Voting  With  the  "Votomatic"  Card 

A  voter  uses  the  "votomatic"  card  for  voting  by  first  inserting 
it  (with  its  attached  end  stub)  in  a  hollow  mechanical  holder. 
(The  holder  is  often  called  a  "votomatic  device"  or  "vote  record- 
er.") The  stub  contains  two  holes.  The  card  is  properly  posi- 
tioned when  the  holes  in  the  stub  are  fitted  over  two  small  posts 
on  the  device.  The  holes  are  assymmetrical  in  the  stub  to  pre-, 
vent  the  voter  from  inserting  the  card  so  as  to  show  its  reverse 
side.  The  system  was  developed  from  a  concept  introduced  by  Dr. 
Joseph  P.  Harris,  whose  early  book  on  election  administration  has 
been  previously  referenced  [24],    [25],  [26]. 

Compared  with  the  lever  machine,  the  mechanical  holder  is  inex- 
pensive. Many  more  holders  could  be  used  in  a  precinct  for  the 
same  cost,  and  therefore,  more  voters  may  simultaneously  vote. 

A  hinged  booklet  is  attached  to  the  mechanical  holder.  The  book- 
let is  attached  so  that  it  is  centered  over  the  inserted  punch 
card.     The  pages  of  the  booklet  are  crimped  to  a  hinge,   as  it  is 
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necessary  that  the  pages  not  be  removed  during  the  voting  pro- 
cess. The  attachment  permits  the  exposure  of  only  one  row  of  the 
punch  card  to  the  view  of  the  voter  at  the  axis  of  the  booklet. 
As  the  pages  are  turned,  a  different  row  of  the  punch  card  is  ex- 
posed for  each  page.  All  voting  instructions,  such  as  office 
names,  candidate  names,  candidate  punch  positions,  and  allowable 
number  of  votes  per  office,  are  presented  on  the  pages.  (In  some 
cases,  the  pages  are  simply  transparent  envelopes  and  the  ballot 
information  is  provided  on  inserts  within  the  envelopes.  In 
those  cases,  the  envelopes  are  sealed  following  insertion  of  the 
ballot  information.)  The  names  of  the  candidates  and  issue 
choices  must  be  positioned  on  the  pages  so  that  each  is  next  to 
the  appropriate  voting  location  on  the  card. 

A  vote  is  cast  by  creation  of  a  hole  in  the  punch  card  at  the  de- 
sired location.  Almost  all  unvoted  "votomatic"  cards  are  pre- 
scored,  i.e.,  each  voting  location  on  the  unvoted  card  is  scored 
in  the  shape  of  a  rectangle.  Sufficient  pressure  on  the  voting 
location  with  a  hand-held  stylus  forces  out  the  inside  of  the 
rectangle,  identified  as  a  piece  of  "chad."  The  need  for  pre- 
scoring  is  due  to  the  simple  nature  of  the  stylus  and  the  inabil- 
ity of  the  voter  to  otherwise  form  a  hole  of  the  dimensions  re- 
quired for  processing  through  a  ballot  reader. 

Recently,  a  new  type  of  stylus  has  been  introduced:  one  which 
does  not  require  a  pre-scored  card.  The  new  stylus  has  a  spring- 
loaded  sleeve.  The  sleeve  provides  sufficient  force  to  punch  out 
pieces  of  round  chad  with  a  diameter  acceptable  for  processing, 
without  the  need  for  pre-scoring.  The  new  stylus  is  used  with 
the  same  type  of  "votomatic"  ballot  holding  device  as  that  used 
for  pre-scored  cards,  but  with  a  change  in  the  device's  internal 
construction.  Precise  manufacturing  of  the  new  internal  "tem- 
plates" that  guide  the  stylus  is  required.  This  type  of  system 
has  been  used  successfully  in  St.  Lucie  County,  Florida.  St.  Lu- 
cie has  about  400  ballot  holder  units  constructed  for  use  with 
the  new  stylus. 

3.4.4  Vulnerabilities  of  the  "Votomatic"  System 

Some  vulnerabilities  that  are  special  to  the  "votomatic"  system 
include  the  following:  the  lack  of  candidate  information  on  the 
card  itself,  the  need  of  the  voter  to  turn  over  all  the  pages  of 
the  booklet  to  get  all  available  voting  information,  possible 
misalignment  of  the  candidate  information  on  the  page  with  the 
appropriate  voting  location  on  the  card,  the  possibility  of  mali- 
cious alteration  in  the  voting  instructions  on  the  pages,  and  the 
problem  of  chad  in  pre-scored  cards. 

Lack  of  candidate  information  on  the  card:  The  fact  that  the 
"votomatic"  card  only  has  numbers  on  it  results  in  a  lack  of  an 
obvious  relationship  to  the  candidate  selected,  once  the  voted 
card    is    removed    from  the   mechanical   holding   device.  However, 
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each  hole  is  numbered,  and  the  instructions  on  the  pages  identify 
each  candidate  and  issue  choice  by  the  corresponding  hole  number. 
In  jurisdictions  that  use  the  system,  campaign  advertising  may 
specify  the  hole  number  of  the  desired  choice  (although  rotation 
of  candidate  sequence  in  different  districts  prevents  candidates 
running  in  multiple  districts  from  having  a  universal  card  loca- 
tion) . 

In  absentee  voting,  the  voter  typically  does  not  have  a  ballot 
holder  available.  The  voter  must  find  the  number  of  the  candi- 
date or  issue  choice  desired  as  listed  on  the  instructions,  find 
the  number  on  the  ballot  that  matches  the  number  of  the  candi- 
date, and  punch  out  the  corresponding  chad. 

Clearly,  the  system  is  not  as  user-friendly  as  a  ballot  or  dis- 
play containing  the  candidate  names,  on  which  each  vote  is  cast 
next  to  the  desired  name,  but  the  "votomatic"  system  may  have 
been  selected  because  of  economy,  or  the  presence  of  a  very  long 
list  of  contests,  for  which  no  viable  alternative  voting  system 
exists.  In  California,  each  voter  receives  a  sample  ballot  in 
the  mail.  Knowledgeable  persons  in  that  state  believe  that  this 
procedure  significantly  improves  the  voter's  ability  to  correctly 
use  the  system. 

Need  to  turn  over  all  pages;  The  voter  must  turn  over  all  the 
pages  of  the  booklet  to  obtain  all  necessary  instructions  and  to 
permit  each  voting  location  to  be  available  for  punching.  Some 
voters  may  forget  to  do  this  and  lose  their  franchise  for  some 
contests  and  issues.  When  the  number  of  candidates  for  a  single 
office  is  very  large,  the  voter  may  be  forced  to  look  on  succes- 
sive pages  to  find  the  total  list.  Confusion  about  voting  for 
such  a  contest  may  result.  If  the  "votomatic"  system  is  selected 
for  other  compelling  reasons,  voter  education  is  the  only  method 
of  assuring  voter  understanding  of  the  voting  process. 

Failure  of  information  alignment:  If  assembly  of  the  mechanical 
holder  and  the  booklet  is  inaccurate,  or  the  location  of  printing 
on  the  pages  is  imprecise,  the  candidate  information  on  the  pages 
may  not  correspond  exactly  to  the  appropriate  voting  location. 
Voter  confusion,  about  which  hole  to  punch,  will  result. 

Malicious  alteration  of  instructions:  It  has  been  charged  (see 
section  2.8.3)  that  the  instructions  on  the  pages  might  be  al- 
tered by  a  particular  voter,  to  the  detriment  of  voters  who  fol- 
low and  use  the  same  mechanical  holder.  Even  if  the  holder  could 
not  be  easily  taken  apart  by  a  voter  and  the  pages  replaced, 
certainly  the  instructions  could  be  defaced  or  covered  over  with 
a  stick-on  label  that  supplies  false  instructions.  A  defense 
against  this  is  alertness  on  the  part  of  the  precinct  officials, 
but  there  are  other  defenses  in  place.  One  defense  is  that  the 
perpetrator  will  have  given  his  verified  name  and  address.  Sec- 
ondly,   the   perpetrator  may   be   observed    if   there    is   no  privacy 
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curtain;  or  a  following  voter  may  note  the  defacement  or  altera- 
tion, thus  limiting  the  possible  perpetrators  to  a  small  number. 
In  addition,  since  many  mechanical  holder  units  are  employed  in  a 
typical  election,  the  damage  done  will  have  a  very  small  effect, 
unless  a  massive  conspiracy  attacking  many  such  units  can  be  as- 
sembled. 

Problem  of  chad  in  pre-scored  cards:  Pre-scored  cards  have  pre- 
sented some  difficulties  in  processing.  Either  a  chad  may  fall 
out  unintentionally,  or  a  chad  that  is  intended  fgr  removal  may 
not  be  fully  removed.  In  either  case,  the  voter's  intent  is  not 
accurately  recorded. 

A  chad  that  is  not  intended  to  fall  out  may  be  loosened  in  hand- 
ling, or  may  be  loosened  in  the  processing  of  the  card  through 
the  card  reader.  Lack  of  care  in  tearing  off  the  stub  of  the 
card  may  loosen  chad.  Undesired  removal  of  chad  in  reading  may 
be  more  likely  if  the  design  of  the  reader  mechanism  requires  the 
card  to  bend.  If  the  card  jams  in  the  reader  and  is  folded  or 
bent,  pieces  of  chad  may  fall  out.  Training  of  precinct  person- 
nel in  card  handling  and  stub  removal,  and  careful  selection  of 
card  readers,  may  alleviate  this  problem. 

During  voting,  a  piece  of  chad  completely  removed  by  the  voter 
should  fall  into  the  mechanical  ballot  holder  and  cause  no  dif- 
ficulty. However,  in  some  cases,  the  voter  fails  to  completely 
remove  the  chad.  This  problem  may  be  due  to  one  or  more  of  sev- 
eral factors,  such  as:  (a)  the  mechanical  holder  may  have  been 
constructed  or  assembled  poorly,  and  the  parts  of  the  holder  are 
not  where  they  should  be,  (b)  the  materials  are  of  poor  quality, 
or  certain  materials  used,  e.g.,  rubber,  may  have  deteriorated 
with  time,  (c)  the  voter  may  have  inserted  the  punch  card  incor- 
rectly into  the  mechanical  holder,  (d)  the  voter  may  attempt  to 
punch  out  the  chad  with  a  less  effective  tool  than  the  stylus, 
such  as  a  ball  point  pen,  (e)  the  voter  may  apply  insufficient 
force,  because  of  a  physical  infirmity  or  because  the  voter  is 
unaware  of  the  requirement  for  complete  chad  removal,  (f)  the  di- 
mensions of  the  punch  card  may  not  be  within  tolerances,  or  (g) 
the  process  of  pre-scoring  the  card  might  have  been  done  poorly. 

A  partially  removed  chad  may  be  pressed  back  into  the  card  during 
the  stacking  of  the  cards  in  preparation  for  reading,  or  during 
the  reading  itself.  If  the  chad  is  pressed  back,  no  vote  will  be 
recorded  for  that  location,  even  if  it  was  the  intention  of  the 
voter  to  cast  that  vote.  A  chad  that  falls  out  during  the  read- 
ing process  may  affect  the  operation  of  the  reader.  Some  elec- 
tion administrations  provide  "inspection  boards:"  bipartisan  pan- 
els of  persons  who  review  each  card  before  processing,  and  who 
remove  hanging  chad  according  to  pre-established  rules.  This 
process  also  identifies  write-ins,  and  catches  the  occasional 
malicious  action,  such  as  the  attachment  of  chewing  gum  or  other 
objects    to    a    card.       Extraneous   objects   may   cause   the   card  to 
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stick  in  the  card  reader,  or  possibly  damage  the  reader  mecha- 
nism. 

3.4.5  Voting  With  the  "Datavote"  Card 

For  voting  on  the  "datavote"  card,  a  stapler-like  tool  is  used. 
The  tool  creates  a  hole  instead  of  inserting  a  staple,  and  the 
tool  provides  sufficient  force  such  that  pre-scoring  of  the  card 
is  unnecessary.  In  order  for  the  tool  to  be  used,  the  card  is 
placed  in  a  holder  which  positions  the  row  to  be  punched  under 
the  hole-punching  part  of  the  tool.  The  tool  is  mounted  on  the 
holder  so  that  it  can  move  up  and  down  the  row  to  the  desired 
column.  The  holder  is  inexpensive,  so  that  several  may  be  used 
at  one  voting  location. 

3.4.6  Vulnerabilities  of  the  "Datavote"  System 

With  the  use  of  the  hole-punching  tool ,  there  is  no  problem  of 
hanging  chad.  Since  the  candidate  information  is  on  the  card, 
there  is  no  potential  for  malicious  alteration  of  voting  instruc- 
tions. 

Multiple  cards;  As  the  "datavote"  card  provides  fewer  voting 
locations  than  the  "votomatic"  card,  even  when  both  sides  of  the 
"datavote"  card  are  used,  more  than  one  "datavote"  card  may  need 
to  be  issued  to  a  voter.  Additional  cards  require  a  certain  ad- 
ditional expense.  In  using  the  "datavote"  system,  a  voter  may 
forget  to  turn  the  card  over,  or  forget  to  use  the  additional 
cards,  thereby  losing  part  of  the  franchise.  As  with  the  problem 
of  turning  over  the  "votomatic"  pages,  voter  education  appears  to 
be  the  only  antidote. 

When  the  number  of  candidates  for  an  office  is  very  large,  both 
sides  of  the  card  may  need  to  be  used  for  the  office.  In  rare 
cases,  e.g.,  for  voting  for  delegates  to  certain  national  party 
conventions,  more  than  one  card  may  be  needed.  In  the  latter 
case,  all  cards  for  the  office  from  a  single  voter  must  be  kept 
together,  to  identify  overvoting. 

Processing  of  multiple  cards:  When  more  than  one  "datavote"  card 
is  issued  to  each  voter,  more  time  must  be  allotted  for  proces- 
sing the  cards  than  for  a  single  card  per  voter,  or  extra  card 
reader  capacity  must  be  added. 

3 . 5  Voting  With  A  Mark-Sense  Ballot 

With  this  type  of  ballot,  the  voter  makes  a  mark  in  a  small  rect- 
angle or  circle  on  a  ballot  to  indicate  a  vote,  and  after  the 
ballot  is  handed  in,  it  is  automatically  read.  Sensing  systems 
originally  employed  electrical  conductivity  to  determine  if  a 
mark  had  been  made,  but  it  is  now  much  more  common  for  light  to 
be    used.       Thus,    the    system    is    often    referred   to    as  "optical 


scan,"  and  is  currently  used  by  about  seven  and  one-half  percent 
of  registered  voters.  Mark-sense  technology  is  widely  used  also 
in  standardized  testing,  for  example  for  college  entrance,  and  in 
statewide  lotteries. 

In  the  use  of  light  as  a  sensor  (or  other  part  of  the  electromag- 
netic spectrum,  such  as  infra-red) ,  the  beam  impinges  on  the  vot- 
ing location,  and  the  guality  of  the  reflection  of  the  beam  is 
used  to  determine  whether  or  not  a  mark  is  present.  With  the 
system  employing  infra-red,  the  voter  is  not  limited  to  any  par- 
ticular writing  instrument  or  pencil  hardness,  provided  that  the 
mark  is  not  colored  red. 

Mark-sense  ballots  are  typically  not  designed  in  the  size,  pro- 
portions, or  thickness  of  the  standard  punch  card.  In  most 
cases,  they  are  larger,  in  order  to  allow  for  the  printing  of 
candidate  and  issue  choice  information  directly  on  the  ballot, 
while  retaining  just  a  single  sheet  as  a  ballot.  As  with  the 
"datavote"  punch  card,  separate  blank  lines  may  allow  for  write- 
in  candidates.  A  numbered  stub  should  be  attached  when  issued, 
to  permit  proper  accounting.  No  special  holding  device  is  re- 
quired for  use  by  a  voter. 

3.5.1  Vulnerabilities  of  Mark-Sense  Ballot  Systems 

Mark-sense  ballots,  like  punch  card  ballots,  have  the  same  poten- 
tial for  ballot  manipulation  frauds  as  paper  ballots,  and  the 
same  administrative  controls  may  be  applied  as  countermeasures . 

Ballot-reader  and  ballot  requirements;  As  with  punch  card  bal- 
lots, accuracy  of  the  reader  is  fundamental.  The  reader  must  be 
sufficiently  sensitive  to  read  the  marks  without  being  too  sensi- 
tive so  as  to  mistake  smudges  for  votes.  Similarly,  if  ballots 
are  automatically  fed,  readers  must  be  designed  so  as  to  trans- 
port only  one  ballot  at  a  time.  Jams  of  ballots  in  the  reader 
must  be  adequately  dealt  with  to  assure  accurate  counting.  Fur- 
thermore, printing  of  the  basic  control  information  (timing  marks 
and  voting  locations)  on  the  ballot  must  be  precise.  The  needed 
precision  may  increase  printing  costs. 

Treatment  of  reader-rejected  ballots:  Some  mark-sense  readers 
appear  to  have  a  problem  in  reading  a  fraction  of  the  ballots 
(they  provide  a  "go-no-go"  indication)  without  any  differences 
between  the  read  and  unread  ballots  being  obvious  to  an  observer. 
Ballots  given  a  "no-go"  indication  by  the  reader  may  be  separated 
by  the  mechanism  and  returned  to  the  input,  to  allow  for  reentry. 
Rules  for  treatment  of  ballots  unreadable  by  machine  should  be 
instituted  to  ensure  that  each  voter's  choices  are  counted,  if 
the  voter's  intent  can  be  determined  (see  section  4.9  for  a  per- 
tinent example) . 

A  positive   feature  of  one   reader   implementation  is  that   it  re- 
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turns  the  uncounted  ballot  to  the  voter  if  the  voter  has  over- 
voted  any  office,  thereby  giving  the  voter  a  chance  to  eliminate 
the  overvote. 

3 . 6  Precinct  Versus  Central  Count  For  Machine-Readable  Ballots 

While  voting  on  punch  card  and  mark-sense  ballots  is  carried  out 
at  precinct  locations,  counting  of  the  votes  may  be  done  either 
at  the  precincts  or  at  a  central  location.  When  voting  with  ma- 
chine-readable ballots  first  started,  there  were  no  micro-com- 
puters, and  all  counting  was  done  centrally.  With  the  develop- 
ment of  inexpensive  small  computers  not  requiring  a  special  envi- 
ronment, the  possibility  of  precinct  counting  of  ballots  became 
viable. 

The  selection  of  precinct  versus  central  count  is  often  a  politi- 
cal decision,  in  which  the  desire  for  local  control  and  decen- 
tralized decision-making  is  traded  off  against  the  higher  costs 
for  procurement,  maintenance  and  support  of  many  small  machines. 
Local  control  appears  to  be  important  where  there  are  strong 
neighborhood  political  organizations  that  believe  that  producing 
the  tally  locally,  hopefully  one  that  favors  their  party,  assists 
in  attracting  committed  individuals  to  the  cause.  The  ability  to 
see  the  tally  produced  and  carry  it  to  the  central  summarization 
location  is  seen  as  a  reward  for  precinct  service. 

With  counting  at  the  precincts,  unofficial  results,  obtained  from 
a  small  removable  storage  unit  of  each  machine,  may  be  transmit- 
ted over  telephone  lines  or  hand-carried  to  the  central  location, 
thereby  providing  a  rapid  indication  of  the  local  outcomes.  Los 
Angeles  County,  the  largest  local  government  jurisdiction  in  pop- 
ulation, continues  to  use  central  counting,  while  Chicago,  among 
our  largest  cities,  uses  precinct  counting.  In  Chicago,  summa- 
rized precinct  results  on  removable  data  storage  devices  are 
hand-carried  to  regional  centers,  from  which  the  data  is  trans- 
mitted over  phone  lines  to  a  central  location. 

3.6.1  Vulnerabilities  of  Precinct  Count  and  Central  Count 

The  selection  of  precinct  count  or  central  count  is  a  trade-off. 
in  vulnerabilities,  as  well  as  in  other  factors. 

Central  count:  Uncounted  ballots  must  be  transported  to  the 
central  location.  The  transportation  of  the  ballots  is  an  inse- 
cure process  requiring  effective  controls. 

The  centralization  of  counting  provides  additional  vulnerabili- 
ties, in  the  possible  mixup  of  ballots  from  different  precincts, 
and  in  computer  operations.  Often,  a  "header"  card  is  added  to 
the  top  of  each  precinct  deck  of  ballot  cards  to  be  read.  The 
use  of  "header"  cards  implies  that  the  complete  instructions  to 
the  computer  are   not   already   in  the  program,    but  are  partially 
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provided  by  these  cards.  Thus,  it  is  important  that  the  "header" 
cards,  as  well  as  all  operator  instructions  to  the  computer,  be- 
come part  of  the  official  records  of  the  election.  Backup  com- 
puter components  must  be  available  to  prevent  total  breakdown  in 
a  central  count  system.  (See  section  4.11  for  an  example  of  a 
partial  breakdown.) 

Precinct  count:  Machines  have  to  be  transported  to  precinct  pol- 
ling places  at  least  one  day  before  an  election.  These  locations 
are  relatively  insecure  against  a  motivated  and  dedicated  adver- 
sary. At  the  polling  places,  there  must  be  concern  to  prevent 
tampering  as  well  as  theft.  A  precinct-located  machine  usually 
has  an  EPROM  (erasable,  programmable  read-only  memory)  that  is 
inserted  in  it  to  specialize  the  machine  for  the  particular  bal- 
lot conditions  in  that  precinct.  Particular  care  must  be  taken 
to  protect  the  EPROM  against  tampering,  removal,  accidental  in- 
terchange with  another  EPROM,  or  replacement  with  an  EPROM  con- 
taining incorrect  data.  The  EPROM  may  be  attached  with  a  seal  to 
make  tampering  more  difficult,  and  the  EPROM  may  have  data  on  it 
which  will  make  it  operative  only  if  it  is  inserted  in  the  ma- 
chine for  which  it  is  intended. 

Transmission  of  precinct  results  over  telephone  lines  to  a  cen- 
tral location  is  a  potentially  inaccurate  and  insecure  process 
requiring  consideration  of  controls.  Transmission  of  results 
needs  no  special  security  if  only  unofficial  and  summarized  re- 
sults are  transmitted  after  the  polls  are  closed,  and  connections 
are  made  only  from  the  central  station  outwards.  Encryption 
should  be  considered  if  individual  choices  or  summarized  results 
are  to  be  transmitted  before  the  polls  are  closed,  or  if  the 
transmitted  data  is  considered  to  be  official.  Other  special 
hardware  and  software  controls  are  required  if  dial-in  connec- 
tions are  to  be  made.  A  useful  analysis  of  security  controls 
that  may  be  used  is  available.  [31]  To  assure  accuracy  of  trans- 
mission, provision  for  parity  checks  and  retransmission  in  case 
of  error  should  be  included  in  the  communications  equipment  ac- 
quired for  this  purpose. 

3 . 7  Direct  Recording  Electronic  (PRE)  Machines 

This  type  of  machine,  the  newest  entry  in  applying  computer  tech- 
niques to  voting,  is  an  electronic  implementation  of  the  lever- 
machine  concept.  This  system  type  is  currently  used  by  slightly 
more  than  two  and  one-half  percent  of  U.S.  registered  voters. 

As  with  a  lever  machine,  there  is  no  ballot;  the  possible  choices 
are  visible  to  the  voter  on  the  front  of  the  machine.  The  voter 
directly  enters  choices  into  electronic  storage  in  the  machine 
with  the  use  of  a  touch-screen,  or  pushbuttons,  or  similar  de- 
vices. If  an  alphabetic  keyboard  is  provided  with  the  voter- 
choice  entry  device,  write-in  possibilities  are  significantly 
eased. 
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The  voter's  choices  are  stored  in  the  machine  and  summed  there 
with  all  other  voters'  choices.  At  the  close  of  polls,  summaries 
from  all  machines  are  then  combined  to  yield  final  results.  (If 
the  machine  simply  produces  a  ballot  to  be  reviewed  by  the  voter 
for  correctness,  and  then  the  ballots  are  tallied  to  produce  the 
final  count,  the  machine  cannot  be  categorized  as  DRE.) 

The  determination  of  the  number  of  individual  DRE  machines  re- 
quired at  a  particular  location  requires  the  same  type  of  consid- 
erations as  for  lever  machines.  As  a  DRE  machine  essentially 
consists  of  a  voter-choice  entry  station  and  a  computer  to  summa- 
rize choices,  an  implementation  using  several  voter-choice  entry 
devices  and  one  computer  is  possible.  In  the  latter  system,  sev- 
eral voters  simultaneously  use  individual  entry  devices  to  record 
their  votes.  Votes  are  summarized  in  a  single  computer  installa- 
tion that  serves  all  such  devices  at  the  precinct. 

As  with  lever  machines,  overvotes  are  prevented  on  DRE  machines, 
but  undervotes  are  permissible.  In  a  typical  machine,  the  vot- 
er's choices  are  entered  into  a  temporary  storage  unit.  The 
storage  unit  controls  a  display,  visible  only  to  the  voter,  of 
the  choices  made.  With  this  feedback,  the  voter  is  given  some 
reason  to  believe  that  the  desired  choices  have  been  entered  cor- 
rectly into  the  temporary  storage,  but  no  independent  proof  can 
be  provided  to  the  voter  that  the  choices  have,  in  fact,  been  en- 
tered correctly  for  the  purpose  of  summarizing  those  choices  with 
all  others  to  produce  vote  totals. 

3.7.1  Summarization  of  DRE  Machine  Results 

As  a  precinct-located  machine,  a  DRE  machine  may  have  its  results 
recorded  on  a  removable  data  storage  device  or  on  a  printout  or 
both.  The  printout  or  device  may  be  carried  to  a  central  sta- 
tion, or  the  data  taken  from  the  storage  device  may  be  transmit- 
ted over  telephone  lines.  As  with  precinct-located  ballot-tally- 
ing machines,  there  must  be  consideration  of  accuracy  and  secu- 
rity controls  over  such  transmissions. 

3.7.2  Vulnerabilities  of  DRE  Machines 

While  the  DRE  machine  is  an  electronic  implementation  of  the  lev- 
er machine  concept,  there  is  a  significant  distinction  between 
them,  other  than  their  use  of  different  technology.  To  prepare 
for  each  election,  each  lever  machine  is  separately  and  individu- 
ally set  up  (although  several  may  be  set  up  by  the  same  techni- 
cian) . 

Centralization  of  setup;  Each  DRE  machine  in  an  election  re- 
ceives its  EPROM  for  set  up  from  a  single  central  source  (the 
same  as  precinct-located  ballot-tallying  machines) .  In  addition, 
the  instructions  on  the  face  of  the  machine  may  be  similarly  pro- 
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duced  centrally  by  computer.  This  centralization  provides  the 
opportunity  for  added  efficiency  and  elimination  of  errors  in  the 
manual  production  of  large  numbers  of  ballot  displays.  However, 
there  is  the  danger  that  centrally-created  errors  that  are  not 
discovered  will  be  propagated  throughout  the  system. 

No  audit  trail  of  voters'  choices:  There  is,  also,  a  problem 
with  DRE  machines  that  is  not  present  with  ballot-tallying  ma- 
chines. This  problem  is  the  verification  that  the  voter's 
choices  have,  in  fact,  been  entered  for  summation  precisely  as 
the  voter  desired.  The  fact  that  the  voter  can  see  his  or  her 
choices  on  a  display,  or  even  receives  a  printout  of  the  choices 
made,  does  not  prove  that  those  were  the  choices  actually  record- 
ed in  the  machine  to  be  summarized  for  generating  the  results  of 
the  election. 

The  assumption  of  correct  recording  of  voter's  choices  must  be 
bolstered  with  extensive  pre-election  and  post-election  review 
and  testing  of  the  logic  of  the  machine,  and  further  assurance 
that  this  logic  cannot  be  fraudulently  altered  after  the  pre- 
election test.  Furthermore,  should  this  logic  fail  during  the 
voting  process,  the  logic  must  have  been  designed  to  fail  in  such 
a  way  that  the  failure  is  obvious  to  the  voter.  Otherwise,  the 
voter  will  have  no  chance  of  ensuring  that  his  or  her  votes  are 
cast  on  a  correctly  operating  machine. 

Difficulty  in  operabilitv  verification;  Pre-election  and  post- 
election testing  of  DRE  machines  is  more  difficult  than  ballot- 
tallying  machines  because,  like  lever  machines,  data  input  to  a 
DRE  machine  is  from  a  human.  To  statistically  test  the  data-en- 
try correctness  of  a  ballot-tallying  machine,  a  large  number  of 
ballots  is  needed,  or  a  smaller  number  entered  many  times  may  be 
used.  To  statistically  test  the  data-entry  correctness  of  a  DRE 
machine,  either  a  person  or  persons  have  to  vote  many  times,  or  a 
device  must  be  built  to  simulate  the  action  of  a  person. 

When  the  voter  indicates  to  the  machine  (e.g.,  by  pushing  a  par- 
ticular button)  that  the  voting  process  has  been  completed,  the 
contents  of  the  temporary  storage  unit  are  added  to  the  more  per- 
manent vote  summary  storage.  Correct  operation  of  the  summariza- 
tion process  must  be  similarly  assured. 

Some  assurance  of  the  machine's  correct  operation  of  the  summari- 
zation process  may  be  achieved  by  the  retention,  in  a  more  perma- 
nent form,  of  the  set  of  each  individual  voter's  choices  that  are 
determined  by  the  machine.  These  voter-choice  sets  have  to  be 
retained  in  randomized  locations  so  that  no  set  of  choices  can  be 
traced  to  a  particular  voter.  If  individual  voter-choice  sets 
are  retained,  they  can  serve  as  insurance  against  the  occurrence 
of  certain  difficulties.  These  difficulties  are  that  the  con- 
tents of  the  temporary  storage  unit  may  be  incorrectly  added  into 
the  more  permanent  vote-summary  storage,  or  that  the  vote-summary 
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storage  may  be  accidentally  erased  before  it  can  be  added  to  the 
final  totals  after  the  close  of  polls.  The  sets  of  voters' 
choices  on  a  particular  DRE  machine  may  be  summarized  on  an  inde- 
pendent DRE  machine  or  general-purpose  computer  for  verification. 

With  DRE  machines,  no  independently  created  ballots  are  available 
for  verification  of  the  correctness  of  both  steps  of  the  vote- 
tallying  process,  identified  as  steps  (3)  and  (4)  in  section  3.1: 
precise  recording  of  the  expression  of  each  voter's  choices,  and 
accurate  summarization  of  all  voters'  choices  to  yield  final  re- 
sults. Stored  voter-choice  sets  may  be  used  to  verify  only  the 
latter  of  these  two  steps.  The  machine-produced  recording  of  the 
expression  of  each  voter's  choices  is  not  independent  of  the  ma- 
chine process  that  produced  it.  The  machine  cannot  be  used  to 
independently  verify  its  own  correctness. 

Precinct  location:  As  DRE  machines  are  precinct-located,  there 
must  be  the  same  or  greater  concern  for  the  vulnerabilities  of 
that  situation  as  those  listed  above  for  precinct-located  ballot- 
tallying  machines.  These  concerns  include  the  risk  of  theft, 
tampering,  fraudulent  replacement  of  an  EPROM,  accidental  inter- 
change of  EPROMs,  and  of  defacement  or  alteration  of  the  voting 
surface.  Protection  of  the  internal  logic  of  the  DRE  machine 
must  be  of  greater  concern  than  with  other  types  of  machines, 
because  of  the  lack  of  independently  generated  ballots. 

3 . 8  Software  For  Computerized  Vote-Tallying 

Software  that  is  intended  for  use  in  more  than  one  election  is 
usually  written  in  a  generalized  form,  and  then  is  specialized 
for  a  specific  election.  The  generalized  software  may  be  provid- 
ed with  a  set  of  tables  whose  values  are  to  be  filled  in  during 
specialization. 

This  two-step  process  may  be  applied  to  any  form  of  computerized 
system:  punch  card,  mark-sense,  or  DRE.  The  specialization  pro- 
cess establishes  the  number  and  names  of  offices  and  issues  to  be 
considered  by  the  voters,  the  number  of  candidates  and  their 
names  for  each  office,  the  number  of  allowable  votes  for  multiple 
selection  situations,  and  the  implementation  of  special  voting 
rules,  such  as  for  treatment  of  straight-party  overvotes  and  for 
crossover  voting.  When  the  implementation  for  which  the  software 
is  being  provided  includes  precinct-located  machines,  the  spe- 
cialization process  includes  provision  of  the  necessary  parame- 
ters to  complete  the  tables  in  the  software  of  those  machines.  A 
device  may  be  provided  that  can  be  used  to  copy  the  parameters  of 
the  election  for  each  precinct  from  the  main  computer  into  the 
EPROM  of  the  appropriate  precinct-located  machine. 

Software  written  for  general-purpose  mainframe  computers  may  be 
written  in  a  high-level  language  such  as  COBOL.  Mainframe  com- 
puters are  likely  to  be  provided  with  extensive  support  software. 
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such  as  compilers  and  programs  for  peripheral  interfacing.  The 
availability  of  such  support  makes  the  use  of  a  language  such  as 
COBOL  a  reasonable  decision.  (However,  see  the  discussion  in 
3.8.1  on  "hidden  code"  in  connection  with  general-purpose  comput- 
ers.) With  the  advent  of  single-purpose  precinct-located  ma- 
chines having  limited  support  software,  much  vote-tallying  soft- 
ware now  tends  to  be  written  in  assembly  language.  Assembly  lan- 
guage may  have  an  additional  advantage  in  providing  the  developer 
with  more  confidence  that  the  real-time  requirements  of  on-line 
ballot  processing  will  be  achieved  by  the  object  code.  However, 
assembly  language  is  considerably  more  difficult  to  review  for 
logical  correctness. 

3.8.1  Vulnerabilities  of  Software 

Vulnerabilities  of  software  include  logical  errors,  the  possibil- 
ity of  "hidden  code,"  and  undocumented  changes.  No  system  type, 
punch  card,  mark-sense,  or  DRE,  is  immune  from  these  threats. 
Protection  against  these  threats  requires  implementation  of  ef- 
fective management  procedures  that  assure  system  integrity  and 
security. 

Logical  errors;  Several  categories  of  logical  errors  need  to  be 
separately  considered.  First,  a  distinction  may  be  made  between 
generic  logical  errors  that  are  independent  of  the  conditions  of 
elections,  and  election-related  errors.  Then,  the  latter  may  be 
subdivided  into  rule-implementation  errors  and  setup-condition 
errors.  Rule-implementation  errors  concern  pre-established  vot- 
ing rules,  such  as  for  crossover  voting  and  for  straight-party 
overvotes.  Setup-condition  errors  involve  specific  election  mat- 
ters, such  as  wrong  rotations  and  incorrect  assignments  of  candi- 
dates to  districts. 

Generic  logical  errors;  These  should  be  identified  and  eliminat- 
ed during  qualification  testing,  in  preparation  for  State  certi- 
fication. Qualification  may  be  done  once,  by  a  national  testing 
laboratory,  to  satisfy  the  requirements  of  many  States.  Ideally, 
qualification  should  include  a  test  of  all  possible  features  and 
functions  and  combinations  of  them.  Resource  constraints  may 
limit  testing  to  only  some  of  the  possible  combinations  of  pro- 
gram features  for  a  system.  Qualification  testing  may  involve 
review  of  logical  flow  charts  and  specific  program  code,  as  well 
as  determination  of  system  response  to  the  normal  flow  of  ballot 
data.  Additionally,  responses  may  be  evaluated  against  the  input 
of  incorrect  data,  special  cases,  large  volumes  of  data,  and  un- 
planned hardware  failures  while  processing.  Guidance  in  planning 
computer  software  acceptance  testing  is  available  [32],  [33]. 

Rule-implementation  errors;  Qualification  testing  requires  eval- 
uation of  the  software  as  it  will  be  implemented,  so  that  elimi- 
nation of  rule-implementation  errors  should  be  a  byproduct  of 
this  activity.      A  particularly  difficult  type  of  rule  to  imple- 


43 


ment  is  the  required  restriction  in  some  States  to  one  vote  per 
candidate  per  voter  in  a  vote-for-two  situation  when  a  candidate 
is  listed  on  two  party  lines  for  the  same  office.  Should  a  voter 
attempt  to  vote  for  the  same  candidate  on  both  party  lines  in 
this  situation,  an  incorrectly  implemented  DRE,  punch  card,  or 
mark-sense  system  may  assign  the  candidate  two  votes.  An  example 
of  an  occurrence  of  a  rule-implementation  error  for  straight-par- 
ty overvote  is  given  in  section  4.4.2. 

Setup-condition  errors:  Elimination  of  setup-condition  errors  is 
necessary  as  an  activity  in  pre-election  system  checkout.  In 
precinct-count  systems,  it  is  important  to  verify  that  the  com- 
puter is  implemented  for  the  same  rotation  and  other  setup  condi- 
tions as  seen  on  the  ballot  for  that  precinct.  In  central-count 
systems,  testing  the  system  against  a  large  number  of  ballots  or 
ballot  images  may  bring  to  light  the  presence  of  setup-condition 
errors.  In  any  system  in  which  there  is  ballot  rotation,  it  is 
important  to  assure  that  the  summarization  of  each  candidate's 
votes  is  correct,  considering  the  different  ballot  position  of 
the  candidate  in  the  various  precincts.  See  section  3.8.2  for 
additional  automation  that  could  alleviate  the  problem  of  setup- 
condition  error. 

"Hidden  code";  This  term  refers  to  a  secret  computer  program  in- 
serted into  another  program  provided  to  an  unaware  user.  Soft- 
ware that  contains  such  hidden  code  is  often  called  "Trojan 
horse"  software.  Hidden  code  that  has  a  function  of  copying 
itself  into  a  user's  program  and  being  transferred  elsewhere  to 
repeat  its  intent  is  often  referred  to  as  a  "computer  virus." 
The  purpose  of  the  hidden  code  may  be  malicious,  or  it  may  be 
used  to  demonstrate  the  prowess  of  the  perpetrator,  or  to  surrep- 
titiously record  information  for  later  retrieval. 

Assuring  the  absence  of  any  hidden  code  within  a  vote-tallying 
program  is  essential  to  system  integrity;  it  should  be  a  part  of 
the  qualification  process.  The  task  may  be  assisted  with  the  use 
of  a  software  engineering  tool  that  identifies  the  use  of  each 
path  in  the  program  during  program  execution.  If,  in  the  exer- 
cise of  a  vote-tallying  program,  a  particular  path  is  not  used 
(because  the  conditions  that  select  it  have  not  been  employed) , . 
such  a  path  may  be  further  investigated  to  determine  the  selec- 
tion conditions. 

The  problem  of  finding  hidden  code  is  complicated  when  vote-tal- 
lying software  is  mounted  on  a  general-purpose  computer.  Hidden 
code  may  have  been  initially  placed  in  a  support  program  of  the 
computer,  for  example  the  compiler  or  operating  system.  Such 
hidden  code  may  be  activated  when  the  support  program  is  called 
from  the  vote-tallying  program.  If  a  clock  could  be  accessed  by 
the  hidden  code,  activation  could  be  arranged  to  occur  at  a  par- 
ticular time  on  a  particular  day.  The  identification  of  the 
presence  of  such  hidden  code  could  be  difficult  and  time-consum- 
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ing,  and  a  deliberate  search,  without  specific  evidence  that  the 
code  exists,  could  be  impractical. 

Assuring  system  integrity  with  management  controls:  Realistic 
protection  against  the  presence  of  hidden  code  in  a  general-pur- 
pose computer  installation  involves  the  application  of  management 
controls  over  the  installation.  An  important  control  for  pro- 
tection against  hidden  code  is  the  requirement  that  software  be 
supplied  only  from  an  original  manufacturer  who  is  known,  reli- 
able, and  can  be  held  accountable.  The  copying  of  software  from 
secondary  sources  should  be  forbidden. 

Modifications  to  software  must  be  strictly  controlled  to  prevent 
unauthorized  changes.  Restrictions  must  be  in  place  to  control 
access  to  program  codes  that  have  been  approved  for  operation. 
Authorized  changes  should  be  documented.  Previous  versions  of 
revised  software  should  be  retained  according  to  established  pro- 
cedures. Due  to  the  threats  from  "hidden  code,"  computer  pro- 
grams have  been  written  that  protect  against  it.  The  protective 
program  is  intended  to  run  with  an  application,  and  to  identify 
any  modifications  that  are  made.  However,  it  is  necessary  that 
the  application  be  initially  free  of  any  "hidden  code"  because 
only  subsequent  changes  can  be  identified.  In  addition,  the  pro- 
tective program  might  not  be  able  to  prevent  unauthorized  modifi- 
cation of  computed  data  that  is  undertaken  during  operation  from 
outside  the  program,   for  example,   from  the  operating  system. 

An  additional  strategy  to  protect  system  integrity  in  vote-tally- 
ing is  to  have  the  vote-tallying  software  provided  by  its  devel- 
oper with  all  necessary  support  software,  including  the  operating 
system,  as  a  complete  package.  No  other  software  would  be  neces- 
sary. In  this  way,  the  complete  software  for  vote-tallying  is 
separated  from  the  influences  of  all  other  software.  It  is  com- 
mon practice  for  software  for  precinct-located  machines  to  be 
provided  in  this  condition.  In  the  future.  States  may  require 
the  complete  package  of  software  (for  any  type  of  vote-tallying 
system)  to  be  deposited  with  the  chief  elections  official  or  an 
escrow  agent,  so  that  the  provision  of  a  complete  package  of 
software  is  responsive  to  this  anticipated  request. 

The  provision  of  a  complete  software  package  enables  an  addition- 
al protection  to  be  applied:  the  data  authentication  code  (DAC) 
[34].  This  code  value,  a  binary  number,  is  computed  by  first 
randomly  selecting  a  certain  key  value,  and  then  applying  that 
key  and  a  specific  mathematical  function  to  the  software  pack- 
age. The  key  value  is  kept  secret.  The  computation  of  the  DAC 
(which  contains  the  same  number  of  bits  as  the  key)  protects  the 
software  against  both  accidental  and  intentional,  but  unauthor- 
ized, data  modification.  To  apply  the  function,  the  software 
package  is  treated  as  if  it  were  a  digitally-encoded  message,  as 
the  DAC  was  developed  to  authenticate  messages  transmitted  over 
communication  lines.      In  application,   the  DAC  would  be  generated 
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for  the  original  software  deposited  with  the  State,  and  would  be 
generated  also  for  the  supposedly  identical  software  used  in  an 
election.  The  two  values  of  the  DAC  will  be  identical  if  the 
software  packages  are  identical.  (The  software  to  be  used  in  an 
election  would  have  to  be  compared  with  the  master  copy  before 
subsequent  specialization  for  the  election.) 

There  is  a  very  small  possibility  that  other  software  packages 
will  have  the  same  DAC  value.  If  the  software  were  altered,  the 
probability  of  the  DAC  being  the  same  for  the  altered  software  is 
extremely  small.  In  fact,  the  probability  is  inversely  propor- 
tional to  the  binary  power  of  the  number  of  bits  in  the  DAC. 
That  is,  with  an  increase  of  one  bit  of  length  in  the  DAC,  the 
probability  of  identicality  is  halved.  Typical  lengths  of  the 
DAC  are  from  32  to  64  bits.  Furthermore,  altered  software  could 
not  be  designed  to  have  the  same  DAC  value  unless  the  persons 
performing  the  alteration  knew  the  secret  key  used  to  create  the 
DAC. 

Assuring  system  security;  Provision  of  all  software  as  a  com- 
plete package  implies  that  the  computer  on  which  the  software  is 
to  run  can  be  dedicated  to  election  operations.  With  the  wide 
availability  and  downward  cost  trend  of  minicomputers  and  micro- 
computers, this  possibility  is  reasonable,  even  for  smaller  elec- 
tion administrations. 

The  advantage  of  a  dedicated  computer  is  that  access  to  the  com- 
puter installation  may  be  restricted  by  the  election  administra- 
tion. Controlled  access  implies  restrictions  on  electronic  ac- 
cess to  files  through  terminals  or  modems  as  well  as  restrictions 
on  personnel  entry  to  controlled  areas.  Sources  of  hardware, 
software,  and  supplies  that  are  used  may  be  controlled  to  assure 
accountability,  as  mentioned  above.  When  the  election  adminis- 
tration simply  serves  as  one  of  many  users  of  a  general-purpose 
installation,  such  restrictions  enforced  by  the  election  adminis- 
tration are  not  generally  available.  The  election  administration 
may  not  be  able  to  assure  that  the  special  concern  for  security 
necessary  in  election  operations  has  the  same  or  higher  priority 
in  the  general-purpose  installation. 

3.8.2  Integration  of  Administrative  Software 

It  is  now  possible  to  integrate  vote-tallying  software  with  other 
software  that  relates  to  the  management  of  elections.  Software 
can  be  provided  that  assists  in  the  establishment  of  districts 
and  precincts,  and  in  the  assignment  of  specific  residence  ad- 
dresses to  specific  precincts.  To  be  most  effective,  this  soft- 
ware would  need  to  be  used  in  conjunction  with  computerized  lists 
of  all  streets,  street  intersections,  and  established  mailing  ad- 
dresses in  the  jurisdiction.  The  vote-tallying  software  would 
not  need  to  be  combined  with  the  election  management  software, 
but  would  require  the  capability  of  being  able  to  receive  data 
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from  it,   for  example,  through  the  use  of  shared  storage. 

Election  management  software  can  be  used  that  helps  establish 
ballot  configurations  and  ballot  rotations,  and  therefore  can  be 
used  in  connection  with  the  production  of  ballots  (for  "datavote" 
and  mark-sense  systems) ,  ballot  pages  (for  "votomatic"  systems) , 
and  ballot  displays  (for  DRE  systems) .  Such  automation  should 
assist  in  the  reduction  of  setup-condition  errors  such  as  rota- 
tion errors  and  candidate  mis-assignment  errors.  Setup-condition 
error  is  a  major  category  of  administrative  error  in  election 
management . 

In  metropolitan  counties  with  a  ballot  rotation  requirement  as 
well  as  with  many  overlapping  minor  jurisdictions,  such  as  incor- 
porated places,  school  districts,  state  legislative  districts, 
and  judicial  districts,  the  number  of  different  ballot  styles  in 
a  consolidated  election  may  be  very  large.  Los  Angeles  county 
employs  about  1800  styles,  while  other  urban  counties  may  use 
between  200  and  600.  (Consolidated  elections,  involving  Federal, 
state,  and  local  offices  simultaneously,  have  been  mandated  in 
many  places  to  reduce  costs  and  improve  voter  participation.) 
Computer  programs  can  assist  in  reducing  the  need  for  multiple 
entry  of  the  same  data,  and  in  sorting  out  the  ballot  require- 
ments of  each  precinct  and  district. 

3 . 9  Local  Conduct  Of  Elections  And  Distribution  Of  System  Types 
3.9.1  The  Number  of  Major  Election  Jurisdictions 

Each  jurisdiction  that  conducts  a  major  election  (an  election  for 
Federal  or  State  officials)  must  consider  the  acquisition  and  use 
of  vote-tallying  equipment.  Thus,  such  a  jurisdiction  would  need 
to  consider  the  information  provided  above  in  this  chapter.  The 
ability  of  such  a  jurisdiction  to  bring  resources  to  bear  on  the 
issues  of  acquisition  and  use  of  vote-tallying  equipment  may  af- 
fect its  capability  to  effectively  carry  out  its  responsibili- 
ties. 

The  discussion  below  identifies  the  jurisdictions  that  carry  out 
major  elections.  The  data  show  that  there  are  a  large  number  of 
small  jurisdictions  with  election  administration  responsibili- 
ties. Application  of  resources  available  at  the  State  level  may 
be  necessary  to  provide  smaller  jurisdictions  with  the  capabil- 
ity to  adequate  deal  with  all  of  the  issues  of  computerized  vote- 
tallying. 

In  the  United  States,  the  responsibility  for  administration  of 
elections  is  a  State  function  (although  the  Federal  Government 
may  impose  requirements,  and  has  done  so)  .  Our  only  officials 
elected  nationwide,  the  President  and  Vice-President,  are  indi- 
rectly elected  by  the  selection  of  "electors"  in  each  State.  In 
each  State,    local  governments  actually  conduct  the  elections  for 
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state  and  Federal  offices,  as  well  as  for  offices  within  their 
own  jurisdictions.  In  41  of  the  States,  these  major  elections 
are  carried  out  at  the  county  level.  (In  four  of  these  States, 
certain  "independent"  cities  serve  as  county-equivalents  and  sim- 
ilarly carry  out  these  elections.) 

In  nine  States,  major  elections  are  carried  out  in  units  of  gov- 
ernment called  minor  civil  divisions  (MCDs)  by  the  U.S.  Bureau  of 
the  Census.  An  MCD  is  a  first-order  division  of  a  county,  and 
only  States  in  the  Northeast  and  Midwest  have  such  units.  An  MCD 
may  be  a  municipality  (e.g.,  a  city),  or  it  may  be  another  type 
of  jurisdiction.  The  nine  States  in  which  MCDs  conduct  major 
elections  are  Michigan  and  Minnesota,  in  which  the  non-municipal 
unit  is  called  a  township,  and  the  six  New  England  States  and 
Wisconsin,  in  which  the  unit  is  generally  called  a  town  (although 
other  names,  such  as  "plantation,"  "location,"  and  "gore"  identi- 
fy a  few  units  in  Maine,  New  Hampshire,  and  Vermont) . 

Conduct  of  the  election  at  the  local  level  implies  that,  at  that 
level,  voter  registration  files  are  maintained,  vote-tallying 
equipment  is  procured  and  maintained,  voting  locations  are  deter- 
mined, precincts  are  staffed,  votes  are  counted,  and  election  re- 
sults for  the  jurisdication  are  produced.  In  November  of  each 
even-numbered  year,  when  there  are  many  Federal,  state,  and  local 
officials  elected,  there  are  a  very  large  number  of  mini-elec- 
tions being  administered  simultaneously.  Thus,  the  report  that 
there  were  "Challenges  in  4  States"  [6]  to  a  vote-counting  pro- 
gram should  be  interpreted  to  mean  that  there  were  challenges  to 
particular  contests  in  elections  in  four  local  jurisdictions,  one 
in  each  of  the  identified  States. 

There  are  about  314  0  county-level  units  in  the  United  States,  in- 
cluding some  44  independent  cities  serving  as  county-equivalents. 
However,  only  about  2870  of  them  conduct  elections  for  State  and 
Federal  offices  in  the  41  states  in  which  counties  and  county- 
equivalents  perform  this  function.  There  are  about  7610  MCDs 
conducting  elections  in  the  nine  states  identified  above.  In  ad- 
dition, Washington  (coextensive  with  the  District  of  Columbia) 
and  about  19  other  cities  (including  New  York  and  Chicago) ,  not 
included  above  as  county-equivalents  or  MCDs,  conduct  their  own 
elections.  Thus,  there  are  some  10,500  local  governments  con- 
ducting major  elections  nationwide.  Some  of  them  are  very  large 
in  population,  e.g.,  Los  Angeles  County,  and  New  York  City,  and 
some  are  quite  small,  e.g..  Loving  County,  Texas,  1980  population 
91.  These  10,500  local  governmental  units  essentially  define  the 
potential  for  use  of  vote-tallying  equipment  for  major  elections. 

3.9.2  Distribution  of  System  Types 

The  distribution  of  system  types  (for  precinct  use  only,  exclud- 
ing use  for  absentee  ballots)  has  been  determined  through  a  na- 
tionwide  survey  taken  by  Election   Data   Services,    Inc.    of  Wash- 
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ington,  DC  [35].  The  survey,  based  on  data  acquired  in  the  first 
quarter  of  1988,  shows  the  following  distribution,  according  to 
1986  registration  figures: 


%  Of  Use  By  %  Of  Use  By 

Type  Registered  Voters  Counties 


Paper  Ballots 

6. 

9 

32  . 

6 

Lever  Machine 

32 . 

9 

29. 

2 

"Votomatic"  Punch  Card 

35. 

9 

22  . 

4 

"Datavote"  Punch  Card 

4  . 

3 

2  . 

3 

Mark-Sense  Ballot 

7. 

5 

5. 

6 

Direct  Recording  Electronic 

2  . 

7 

1. 

7 

Mixed 

9. 

8 

6. 

2 

Total 

100. 

0 

100. 

0 

The  "mixed"  systems  are  in  counties  in  which  some  areas  use  the 
"votomatic"  punch  card,  others  continue  to  use  paper  ballots,  and 
a  few  use  lever  machines.  The  distribution  of  these  systems  by 
voter  registration  is  approximately  45%  "votomatic,"  45%  paper 
ballots,  and  10%  lever  machines.  With  this  additional  data,  the 
percent  use  of  systems  by  registered  voters  is  as  follows: 


%  Of  Use  By 
Type  Registered  Voters 


Paper  Ballots  11.3 

Lever  Machines  3  3.9 

"Votomatic"  Punch  Card  40.3 

"Datavote"  Punch  Card  4.3 

Mark-Sense  Ballot  7.5 
Direct  Recording  Electronic      2  .  7 

Total  100.0 


With  some  45  percent  of  voters  still  not  using  computerized 
equipment  (still  using  either  paper  ballots  or  lever  machines) , 
considerable  opportunity  for  the  implementation  of  new  types  of 
systems  continues  to  exist.  For  example,  it  may  be  expected  that 
in  the  near  future  registered  voters'  use  of  DRE  machines  will 
increase  a  percent  or  two,  primarily  as  a  result  of  the  replace- 
ment of  lever  machines. 

3 . 10  Future  Vote-Tallying  Systems 

3.10.1  Technological  Possibilities 

With  the  increasing  availability  of  data  transmission  over  net- 
works of  computers  and  terminals,  there  is  a  possibility  of  on- 
line voting  through  the  use  of  such  networks.  Even  at  present, 
precinct-located  devices  could  be  connected  to  central  computers 
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in  an  on-line  mode.  Whether  this  has  some  benefit  greater  than 
its  costs  is  arguable,  as  results  cannot  be  released  before  the 
polls  close.  Certainly,  communications  security  must  be  a  con- 
sideration . 

Large  single-application  networks  already  in  use  that  are  user- 
oriented  are  networks  for  lotteries  and  for  remote  banking.  Vot- 
ing requires  significantly  more  choices  than  a  lottery  or  remote 
banking.  In  a  lottery,  the  bettor  selects  just  one  or  two  num- 
bers. In  banking,  the  accountholder  typically  makes  a  binary 
choice  of  either  withdrawal  or  deposit,  selects  an  account  type, 
and  specifies  a  single  amount.  In  voting,  there  may  be  Federal, 
State,  and  local  offices  on  the  ballot,  plus  several  questions. 
The  total  number  of  contests  requiring  a  voting  decision  may  be 
twenty  or  more,  and  several  contests  may  permit  a  selection  of 
more  than  one  candidate  from  a  longer  list  of  nominees. 

In  use  of  a  network  for  voting,  the  traffic  conditions  would  be 
extreme.  The  network  would  be  used  only  about  twice  a  year,  but 
when  in  use,  the  volume  of  traffic  would  be  very  high.  In  a 
presidential  election,  over  one-half  the  adults  in  the  nation 
would  be  expected  to  use  the  network  for  about  four  minutes  each 
over  a  twelve-hour  period.  In  Los  Angeles  County,  over  2  00,000 
voting  uses  per  hour  in  a  presidential  election  would  be  re- 
quired. Whether  this  could  be  both  technically  and  economically 
feasible  is  problematic. 

A  possibility  that  may  be  more  economical  is  the  use  of  an  exist- 
ing network  to  which  voting  use  is  added  when  necessary,  provided 
that  the  capability  for  the  volume  of  use  is  present.  The  gener- 
al telephone  network  might  be  utilized  through  voice  response  (to 
advise  the  voter  of  the  choices)  and  push-button  phones  (for  the 
voter  to  make  choices) ,  but  again,  volume  is  a  strongly  limiting 
factor.  Cable  television  is  another  possibility,  if  it  can  be 
generally  implemented  in  an  interactive  mode. 

An  important  requirement  in  voting  is  the  verification  of  regis- 
tration. In  remote-terminal  banking,  verification  of  account- 
holder  status  is  typically  accomplished  at  this  time  with  a  mag- 
netic stripe  credit-type  card  and  a  personal  number.  At  point- 
of-sale  terminals,  it  is  common  for  sales  personnel  to  obtain 
account  status  and  to  debit  accounts  to  an  on-line  system  with 
the  aid  of  data  on  the  magnetic  stripe.  (Lotteries  have  no  per- 
sonal identification  requirement  for  use.)  Whether  it  would  be 
feasible  to  have  such  a  system,  like  the  one  in  use  for  remote 
banking,  for  a  small  number  of  uses  per  year  by  a  very  large  num- 
ber of  persons  is  also  problematic.  Conceivably,  social  security 
number,  driver's  license  number,  or  some  other  permanently  as- 
signed number  could  be  used  as  an  identifier.  A  card  for  voting 
might  have  other  uses  at  public  facilities,  such  as  for  library 
withdrawals  or  parking  in  public  garages. 
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The  process  of  remote  personal  indentif ication  is  the  subject  of 
research.  In  the  future,  if  a  system  with  video  bandwidth  were 
available  (e.g.,  interactive  cable  television),  remote  signature 
verification  could  be  possible.  At  present,  a  precinct  official 
can  compare  a  prospective  voter's  signature  with  a  computer- 
stored  copy,  but  computer  comparison  without  human  intervention 
is  not  yet  considered  to  be  sufficiently  accurate.  With  less 
bandwidth  (e.g. ,  the  telephone  network) ,  voiceprint  verification 
could  be  employed,  but  only  if  that  process  could  be  shown  to  be 
highly  accurate.  Again,  this  application  is  not  considered  to  be 
technically  feasible,  in  a  general  sense,  in  the  immediate  fu- 
ture. It  is  possible  that  a  personally  assigned  "smart  card,"  a 
credit-type  card  with  an  embedded  computer  chip,  could  be  used 
interactively  at  a  computer  terminal  to  aid  the  process  of  remote 
identification. 

3.10.2  Political  and  Social  Priorities 

The  implementation  of  any  system  must  be  in  accord  with  political 
and  social  priorities,  as  well  as  meet  technical  criteria  of  ac- 
curacy and  reliability.  For  example,  any  installed  system  must 
meet  several  basic  requirements:  equal  access  by  individuals  to 
the  voting  franchise,  verification  of  registration,  the  ability 
to  cast  a  vote  in  secret  without  intimidation,  and  assurance  of 
fairness  to  opposing  parties.  The  advantage  of  establishing  pol- 
ling places  (as  opposed  to  voting  from  homes  through  cable  tele- 
vision, for  example)  is  that  neutral  locations  where  voting  can 
occur  without  intimidation  are  set  up.  At  neutral  and  public  lo- 
cations, representatives  of  opposing  parties  can  be  present  and 
can  watch  the  administration  of  the  voting  process.  The  estab- 
lishment of  technological  access  to  the  voting  process  that  is 
available  to  some  persons  but  not  to  others  (because  of  acquisi- 
tion costs  borne  by  individuals)  may  not  be  consistent  with  the 
concept  of  equal  access. 
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4.   SOME  RECENT  DIFFICULTIES  IN  COMPUTERIZED  VOTE-TALLYING 


The  following  are  examples  of  difficulties  that  have  occurred  in 
the  use  of  computerized  vote-tallying,  in  the  years  1980-1986. 
The  purpose  of  providing  these  narratives  is  to  demonstrate  the 
types  of  difficulties  that  have  been  recently  experienced.  These 
reports  provide  support  for  recommendations  concerning  procedures 
that  can  be  followed  so  that  other  election  administrators  may 
avoid  similar  difficulties.  It  is  not  the  purpose  of  these  re- 
ports to  assess  or  assign  responsibility  or  culpability  for  the 
difficulties  experienced. 

The  examples  were  chosen  for  several  reasons.  Four  of  the  situa- 
tions (Carroll  County,  Maryland;  Charleston,  West  Virginia;  Elk- 
hart County,  Indiana;  and  Palm  Beach  County,  Florida)  had  been 
identified  in  an  article  in  the  New  York  Times  [6].  The  situa- 
tion in  Dallas  had  been  reported  there  in  a  separate  article 
[36].  The  remaining  situations  provide  elucidation  of  particular 
types  of  problems  and,  in  addition,  reliable  information  about 
the  situations  was  made  available  by  authoritative  or  competent 
sources. 

As  in  the  1975  vote-tallying  report  [l],in  which  examples  of  re- 
ported difficulties  were  given,  the  descriptions  should  be  read 
with  the  following  caution: 

It  is  not  intended  that  these  descriptions  be  the  definitive  ver- 
sions of  what  occurred.  No  absolute  proof  can  be  offered  that 
the  events  occurred  exactly  as  described.  However,  reported  data 
have  been  supplied  by  named  sources  on  the  scene,  and  exact  quo- 
tations by  participants  and  observers  are  given  when  appropriate. 

4 . 1  Carroll  County,  Maryland;  November,  1984 

Carroll  is  a  county  of  about  100,000  population  whose  county 
seat,  Westminster,  is  located  about  3  0  miles  northwest  of  the 
city  of  Baltimore.  On  November  8,  two  days  after  the  Tuesday, 
November  6,  1984  general  election,  and  in  accordance  with  the 
rules  of  the  Maryland  State  Administrative  Board  of  Election  Laws 
(SABEL) ,  voted  punch  card  ballots  from  two  districts  of  Carroll 
County  were  taken  to  a  neighboring  county,  Frederick,  to  be  rerun 
on  an  independently-managed  system.  (Similarly,  ballots  from 
Frederick  County  were  taken  to  Westminster  to  be  rerun.)  This 
rerun,  in  order  to  verify  the  original  results,  is  necessary 
under  Maryland  regulations  before  the  results  may  be  certified. 

It  was  clear  from  these  reruns  that  one  of  the  computers  used  was 
in  error  in  determining  the  outcome  of  a  contest  between  Wayne 
Cogswell  and  incumbent  T,  Edward  Lippy,  for  Carroll  County  School 
Board.  Manual  counts  of  the  votes  on  ballots  from  both  Frederick 
and  Carroll  Counties  showed  that  the  Carroll  County  computer  was 
the   one  that  was   incorrect.      The  initial  but  unofficial  count. 
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made  public  on  the  evening  of  the  election,  had  incorrectly  indi- 
cated that  Cogswell  was  the  winner. 

An  investigation,  undertaken  the  next  day  (November  9)  by  Craig 
Jester,  a  county  computer  program  contractor,  demonstrated  that  a 
wrong  utility  computer  program  for  reading  the  ballot  cards  had 
been  used.  After  the  correct  utility  program  was  installed,  the 
results  coincided  with  those  obtained  manually  and  with  the  Fred- 
erick County  computer.  The  utility  program,  named  COLBIN,  had 
been  previously  written  by  Jester  under  contract  to  the  county 
and  had  been  successfully  used  in  the  May,  1984,  primary  elec- 
tion. 

The  purpose  of  the  COLBIN  utility  program  was  to  read  the  voted 
ballot  cards  in  the  "column  binary"  format  used  for  voting,  rath- 
er than  in  a  simpler  format.  At  the  request  of  Carroll  County 
data  processing  personnel  and  to  reduce  the  price.  Computer  Elec- 
tion Systems,  the  vendor  of  the  vote-tallying  system,  had  sup- 
plied the  system  with  an  elementary  utility  program  that  could 
read  cards  only  in  the  simpler  format.  With  the  simpler  format, 
ballot  cards  would  be  required  to  have  a  maximum  of  one  punch  per 
column,  not  an  acceptable  situation  for  the  Carroll  County  bal- 
lot. Carroll  County  contracted  locally  (with  Pelorus,  whose 
president  was  Craig  Jester)    for  the  COLBIN  utility  program. 

On  Saturday,  November  10,  the  count  was  rerun  (using  the  vote- 
tallying  system  including  the  COLBIN  program) .  Members  of  the 
county  Board  of  Elections  and  the  County  attorney  were  in  atten- 
dance. The  count  indicated  that  Lippy  was  the  winner.  On  Wed- 
nesday, November  14,  eight  days  after  the  election,  the  Board  of 
Elections  certified  the  results,  naming  Lippy. 

The  cause  of  the  error  was  reported  in  the  Carroll  Sun  on  Nov. 
18,  1984  in  an  article  by  Steve  Kelly  [37],  A  more  complete  ex- 
planation was  provided  in  a  letter,  dated  Nov.  26,  1984,  from 
Thomas  J.  Van  de  Bussche,  Administrator  of  the  Data  Processing 
Center  of  Carroll  County,  to  Dr.  Thomas  Lewis,  President  of  the 
Carroll  County  Election  Board  [38].  Mr.  Van  de  Bussche's  letter 
was  included  in  a  report  submitted  by  Dr.  Lewis  on  December  5, 
1984  to  Mrs.  Marie  Garber,  Administrator  of  SABEL  [39]. 

Mr.  Van  de  Bussche  admitted  that,  in  testing  an  improved  vote- 
tallying  system  provided  by  Computer  Election  Systems,  he  had  in- 
advertently replaced  the  production  version  with  a  test  version 
that  did  not  include  the  COLBIN  utility  program.  The  logic  and 
accuracy  test  of  the  vote-tallying  system  on  Oct.  25,  1984,  per- 
formed prior  to  the  election  in  accordance  with  Maryland  regula- 
tions, produced  results  consistent  with  the  test  ballots  used. 
None  of  the  test  ballots  had  more  than  one  punch  in  any  column. 
Therefore,  the  test  ballots  did  not  reveal  the  error. 

In  the  general  election  of  November  6,    1984,   the  contest  for  the 
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school  board  seat  in  question  was  listed  in  the  same  punch  card 
columns  as  a  home  rule  issue.  The  two  contests  were  listed  on 
different  ballot  pages  of  the  "votomatic"  ballot  holder.  The 
combination  of  votes  for  a  school  board  candidate  and  a  particu- 
lar home  rule  position  in  the  same  column  created  a  punch  config- 
uration that  was  not  recognized  as  valid  by  the  elementary  util- 
ity program.  As  a  result,  some  valid  votes  were  not  recorded  in 
both  the  school  board  and  home  rule  issue  contests.  Most  of  the 
votes  not  recorded  (about  13,000)  were  for  Lippy,  because  many 
Lippy  voters  chose  the  home  rule  position  listed  in  the  same  card 
column.  Votes  not  recorded  on  the  home  rule  issue  did  not  affect 
the  ultimate  outcome  for  that  question.  If  the  COLBIN  utility 
program  had  been  used,  all  votes  on  the  contests  would  have  been 
recognized  as  valid. 

In  summary,  the  incorrect  announcement  of  the  result  of  the 
school  board  contest  on  election  night  was  due  to  mistakes  by  the 
Data  Processing  Center  of  Carroll  County  in  using  the  wrong  util- 
ity program  and  in  using  a  perfunctory  logic  test  that  did  not 
disclose  the  problem  before  the  election.  No  factual  evidence  is 
available  that  contradicts  the  documentation  submitted  to  Mrs. 
Garber  by  Dr.   Lewis  and  Mr.  Van  de  Bussche. 

The  incorrect  announcement  was  not  due  to  any  error  in  the  vote- 
tallying  computer  system  supplied  by  the  primary  vendor.  Computer 
Election  Systems,  nor  any  activity  undertaken  by  its  represen- 
tatives. Nevertheless,  on  July  29,  1985,  the  New  York  Times,  in 
referring  to  this  particular  situation,  reported  that  "The  vote 
counting  program  that  has  been  challenged  in  ....  Maryland  was 
developed  by  Computer  Election  Systems  of  Berkeley,   Calif."  [6] 

The  error  was  discovered  after  the  election  but  before  certifica- 
tion because  of  a  Maryland  regulation  that  required  recounting  on 
an  independently  managed  system.  This  specific  regulation  was 
based  on  a  recommendation  that  "further  confidence  in  the  ma- 
chine-counted results  can  be  achieved  if  mandatory  machine  re- 
counting of  a  percentage  of  the  precincts  for  each  race  is  car- 
ried out  on  a  different,  independently  managed  computing  system 
than  that  used  to  produce  the  official  count."  [40] 

On  June  11,  1985,  another  recount  of  the  school  board  race  in 
question  was  carried  out,  using  the  Carroll  County  computer, 
again  including  the  COLBIN  program.  This  recount  was  undertaken 
at  the  request  of  the  State  court  in  which  Mr.  Cogswell,  the  de- 
feated candidate,  had  filed  a  suit  asking  that  the  results  of  the 
election  be  re-examined.  The  recount  verified  the  correctness  of 
the  election  results  certified  on  Nov.  14,  1984,  although  Mr.  Van 
de  Bussche  has  indicated  that  the  recount  results  did  not  exactly 
match  the  count  reported  in  the  certification. 

Mr.  Van  de  Bussche  has  stated  that  the  recount,  carried  out  with 
all   sides    in   attendance,    was   hurried   and   less   than  precise  in 
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that,  with  the  permission  of  the  court,  card  reader  "checks"  were 
ignored  in  the  ballot-reading  process.  Usually,  a  card  reader 
"check,"  indicative  of  a  reading  failure,  would  result  in  a  deci- 
sion to  re-read  the  entire  precinct  of  voted  ballot  cards.  In- 
stead, the  card  or  cards  causing  the  "check"  remained  unread  and 
the  reading  process  continued.  The  failure  to  re-read  an  entire 
precinct  upon  occurrence  of  a  read  "check"  resulted  in  a  small 
but  random  reduction  of  votes  to  both  candidates,  according  to 
Mr.  Van  de  Bussche.  The  differences  were  not  significant  enough 
to  raise  reasonable  doubt  as  to  the  correctness  of  the  certified 
results . 

According  to  a  July  11,  1985  story  by  Chris  Guy  in  the  Carroll 
County  Times  referring  to  the  court-ordered  recount,  "...defeated 
candidate  Wayne  Cogswell  had  verification  that  use  of  an  incor- 
rect computer  program  caused  a  nearly  13,000-vote  mistake  in  the 
unofficial  totals  released  election  night."  [41] 

4 . 2  Charleston.  West  Virginia;  November.  1980 

The  following  discussion  was  developed  primarily  from  newspaper 
articles  in  the  Charleston  Daily  Mail  and  Charleston  Gazette. 

Following  the  general  election  of  November,  1980,  three  defeated 
candidates  charged  gross  violations  of  election  laws  in  Kanawha 
County,  the  county  in  which  Charleston  is  located.  Defeated  U.S. 
Representative  John  Hutchinson  first  filed  a  complaint  with  the 
U.S.  Department  of  Justice  alleging  that  his  civil  rights  had 
been  violated.  The  other  defeated  candidates  who  joined  Hutchin- 
son in  charging  election  law  violations  were  former  State  Dele- 
gate Leonard  Underwood  and  former  Kanawha  County  Commissioner 
William  Reese.  Underwood,  who  was  the  first  to  initiate  a  suit, 
had  filed  for  a  recount  after  he  was  edged  out  in  the  election  by 
Delegate  John  M.  Wells.  (Underwood  was  re-elected  as  a  State 
Delegate  in  1982.) 

According  to  an  article  on  June  2,  1981  in  the  Charleston  Gazette 
[42],  Darlene  Kay  Dotson,  an  employee  in  the  office  of  the  County 
Clerk,  had  stated  in  a  deposition  taken  for  Underwood's  suit  that 
the  ballots  from  the  election  in  question  had  been  run  through 
the  computer  on  the  day  after  the  election  to  get  "precinct-by- 
precinct  reports."  According  to  law,  the  ballots  are  to  be  se- 
cured for  the  official  canvass,  which  was  not  done  at  that  time. 
Two  members  of  the  County  Commission,  Robert  Silverstein  and  Al 
Shepard,  each  possessed  the  only  key  to  separate  padlocks  that 
were  both  needed  to  open  the  vault  in  which  the  ballots  were 
kept,  and  both  denied  opening  the  vault  or  giving  the  keys  to 
anyone  else  to  do  so. 

According  to  the  June  2,  1981  article,  Carolyn  Critchfield,  also 
an  employee  of  the  office  of  the  County  Clerk,  told  Shepard  that, 
to  her  knowledge,  the  ballots  hadn't  been  out  of  the  vault  before 


the  canvass.  "Shepard  said  Mrs.  Critchfield  believed  Ms.  Dotson 
had  events  confused  with  the  primary  election  when  the  ballots 
were  run  the  day  after  the  election,"  the  article  reported. 

There  was  also  concern  about  a  test  run  of  the  computer's  tabula- 
tion ability.  Ms.  Dotson  had  testified,  according  to  the  newspa- 
per article,  that  neither  County  Clerk  Margeret  Miller,  nor  the 
county  commissioners  would  sign  the  certification  approving  the 
test,  and  that  she  had  to  sign  it. 

Mr.  Underwood  had  filed  for  a  recount  on  December  2,  1980,  and 
then,  on  December  16,  he  asked  the  circuit  court  to  require  that 
the  election  ballots  be  manually  counted  to  compare  them  with  the 
computer  tabulation.  In  early  February,  1981,  a  circuit  judge 
denied  Underwood's  request,  but  on  February  17,  1981,  he  filed  an 
appeal  with  the  state  Supreme  Court,  asking  for  the  manual  count 
or  a  retabulation  by  the  computer.  However,  following  the  cir- 
cuit judge's  denial  of  Underwood's  request,  the  ballots  had  been 
destroyed  by  order  of  the  County  Clerk. 

The  state  law  in  effect  at  that  time  stated  that  ballots  shall  be 
preserved  for  60  days  and  "if  there  be  no  contest  pending  as  to 
such  election  and  their  further  preservation  be  not  required  by 
any  order  of  a  court,  they  shall  be  destroyed."  According  to  Ray 
Dodson,  lawyer  for  the  County  Commission,  Mrs.  Miller  told  him 
that  she  did  not  know  that  Mr.  Underwood  had  filed  an  appeal  in 
the  state  Supreme  Court.  Dodson  said  that  there  is  some  question 
as  to  whether  Underwood's  appeal  constituted  a  true  contest  under 
the  law. 

On  February  24,  1982,  according  to  a  February  25,  1982  article  in 
the  Charleston  Daily  Mail  [43],  County  Clerk  Margaret  Miller  was 
indicted  by  a  special  Kanawha  County  grand  jury  on  six  felony  and 
nine  misdemeanor  charges.  Three  of  the  felony  charges  had  to  do 
with  the  removal  of  ballots  from  packages  after  the  unofficial 
election  night  vote  tally  and  before  the  County  Commission's  vote 
canvass  that  produces  official  totals.  Two  felony  counts  accused 
Mrs.  Miller  with  allowing  a  vault  containing  the  ballots  to  be 
opened  between  election  night  and  the  canvass.  The  other  felony 
charge  stated  that  she  allowed  the  ballots  from  the  general  elec- 
tion to  be  destroyed  while  Underwood's  suit  was  pending.  In 
June,  1983,  Mrs.  Miller  was  found  innocent  of  all  charges.  The 
jury  had  concluded  that  there  was  no  "willful  misconduct."  [44] 

However,  in  February,  1983,  the  three  unsuccessful  1980  candi- 
dates filed  a  civil  suit  in  Federal  district  court  against  Mrs. 
Miller  and  15  other  individuals.  According  to  a  newspaper  arti- 
cle on  February  5,  1983  [45],  the  suit  alleged  that  the  three 
were  prevented  from  being  elected  because  of  a  conspiracy  on  the 
part  of  the  individuals  named  as  defendants.  In  addition  to  Mrs. 
Miller,  defendants  included  Mrs.  Miller's  husband  Steven;  former 
U.S.  Representative  Mick  Staton,  who  defeated  Hutchinson  in  1980; 
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Kanawha  County  Commissioners  Henry  Shores  and  Robert  Silverstein; 
Kanawha  County  Prosecutor  (and  later  mayor  of  Charleston)  James 
Roark;  several  employees  of  the  County  Clerk's  office  including 
Darlene  Dotson  and  Carolyn  Critchfield;  John  Cavacini,  Jr.,  a 
campaign  worker  in  1980  for  Governor  Jay  Rockefeller;  Computer 
Election  Services,  supplier  of  the  electronic  voting  equipment 
used  in  1980  in  Kanawha  County;  several  employees  of  that  compa- 
ny; and  Bernard  H.  Meadows,  deputy  clerk  of  the  Boone  County 
Commission. 

Previous  to  the  filing  of  the  suit,  former  U.S.  Representative 
John  Hutchinson  had  been  reported  as  charging  that  one  of  the  de- 
fendants, John  Cavacini,  Jr.  was  in  possession  of  final  returns 
for  the  1980  election  two  days  after  the  Nov.  4,  1980  election 
and  more  than  30  days  before  the  official  canvass  was  completed 
on  December  8,  1980.  Hutchinson  said,  according  to  a  June  5, 
1982  article  [46],  that  information  in  his  possession 

"...proves  without  any  question,  the  machines  didn't 
count  at  the  canvass.  I  think  the  results  were  prede- 
termined. It's  conclusive  in  as  much  as  the  documenta- 
tion shows  after  numerous  absentee  and  challenged  bal- 
lots were  counted  that  the  totals  didn't  change.  The 
machine  did  not  count  the  ballots." 

Hutchinson  also  added  that: 

"There  is  a  very  great  probability  that  the  numbers 
were  in  the  machine  and  the  machine  never  counted  any- 
thing." 

In  December,  1983,  Hutchinson,  Underwood,  and  Reese  filed  an 
amended  lawsuit  that  specifically  alleged  that  Kanawha  County 
Clerk  Margaret  Miller  and  her  staff  rigged  the  vote-counting 
computers  to  predetermine  the  results,  that  ballots  were  mishan- 
dled, that  some  ballots  were  not  opened  until  the  canvass  and 
then  were  counted  to  meet  a  predetermined  result,  that  all  bal- 
lots were  not  counted,  that  the  vote  canvass  was  falsified,  and 
that  the  computing  equipment  was  not  properly  tested  prior  to  the 
election.  The  three  plaintiffs  also  claimed  that  Boone  County 
election  officials  tampered  with  the  computer  equipment  before 
the  election,  that  ballots  were  altered,  and  that  an  accurate 
ballot  tally  was  not  made.  Irregularities  in  procuring  the  vote- 
counting  equipment  in  both  Kanawha  and  Boone  Counties  were  also 
alleged  [47]. 

In  May,  1985,  the  suit  was  dismissed  (charges  against  several  de- 
fendants had  been  previously  dropped) ,  and  the  Charleston  Daily 
Mail  editorialized  on  May  3,   1985  as  follows: 

"[U.S.  District  Judge  Charles]  Haden  sat  through  days 
of  non-evidence  on  behalf  of  three  plaintiffs  —  former 
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Congressman  John  Hutchinson,  House  of  Delegates  member 
Leonard  Underwood  and  former  county  commission  candi- 
date William  Reese  —  all  of  whom  lost  election  races 
in  198  0  and  have  been  mad  about  it  now  for  more  than 
four  years. 

"The  plaintiffs  were  somehow  allowed  to  bring  this 
petty  case  to  trial.  Throughout,  they  failed  to  pre- 
sent a  particle  of  proof  to  support  their  claims  that 
11  defendants  conspired  to  deprive  them  of  public  of- 
fice. 

"People  who  run  for  election  obviously  like  to  win,  but 
they  must  be  prepared  to  lose.  And  barring  solid  evi- 
dence of  fraud,  they  ought  to  accept  their  losses  gra- 
ciously without  proceeding  to  harass  either  the  indi- 
viduals who  ran  against  them  or  those  who  counted  the 
votes."  [48] 

Appeals  of  the  dismissal  were  similarly  dismissed,  and  the  U.S. 
Supreme  Court  announced  on  February  24,  1987  its  refusal  to  hear 
the  case. 

Possibly  influenced  by  Underwood's  initial  suit  requesting  a  man- 
ual recount  of  the  ballots.  West  Virginia  amended  its  law  on 
electronic  voting  systems  in  1982.  The  revised  subsection  3-4A- 
28    (4)    is  as  follows: 

During  the  canvass  and  any  requested  recount,  at  least 
five  percent  of  the  precincts  shall  be  chosen  at  random 
and  the  ballot  cards  cast  therein  counted  manually. 
The  same  random  selection  shall  also  be  counted  by  the 
automatic  tabulating  equipment.  If  the  variance  be- 
tween the  random  manual  count  and  the  automatic  tabu- 
lating equipment  count  of  the  same  random  ballots  is 
equal  to  or  greater  than  one  percent,  then  a  manual  re- 
count of  all  ballot  cards  shall  be  required.  In  the 
course  of  any  recount,  if  a  candidate  for  an  office 
shall  so  demand,  or  if  the  board  of  canvassers  shall  so 
elect  to  recount  the  votes  cast  for  an  office,  the 
votes  cast  for  that  office  in  any  precinct  shall  be  re- 
counted by  manual  count. 

4 . 3  Dallas.   Texas;  April.  1985 

In  the  election  for  Mayor  of  Dallas,  held  April  6,  1985,  the  in- 
cumbent Starke  Taylor  avoided  a  runoff  by  obtaining  slightly  more 
than  the  required  50%  of  the  vote.  There  were  three  opponents  to 
Taylor:  Morehead,  Goldblatt,  and  Daniel.  Max  Goldblatt,  the 
leading  opponent,  requested  a  recount.  A  machine  recount  (in- 
cluding absentee  ballots  that  were  mixed  in)  was  undertaken  on 
April  11,   1985,  by  order  of  the  District  Court.     The  original  re- 
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suits  and  the  recount  results  are  summarized  below:  [49] 


Original 
Recount 


Morehead 
2,  318 
2  ,318 


Taylor 
38, 998 
38, 973 


Goldblatt 
35, 081 
35, 082 


Daniel 
621 
619 


Write-in 
10 
10 


The  machine  recount  showed  that,  overall,  Taylor's  votes  de- 
creased by  25,  while  Goldblatt 's  votes  increased  by  just  one,  an 
insufficient  change  to  cause  a  runoff  election.  Mr.  Goldblatt 
did  not  raise  a  challenge  to  the  accuracy  of  the  recount  at  that 
time,  and  Mr.  Taylor  was  confirmed  as  Mayor  for  the  two-year 
term. 

Taken  as  a  whole,  the  recount  results  would  appear  to  confirm  the 
vote  totals  produced  in  the  original  count,  but  a  precinct-by- 
precinct  review  [50]  raises  technical  questions  about  the  accura- 
cy of  the  combined  human  and  computer  system  that  produced  them. 
There  were  250  precincts  in  this  election,  but  only  89  precincts 
showed  no  change  in  votes  for  any  of  the  four  candidates  in  the 
contest  for  mayor.  Taylor's  votes  changed  in  100  of  the  250  pre- 
cincts, while  Goldblatt 's  votes  changed  in  113  precincts. 

In  the  recount,  Taylor  lost  one  vote  in  4  5  precincts,  two  votes 
in  each  of  ten  precincts,  three  votes  in  each  of  four  precincts, 
and  five  votes  in  each  of  two  precincts.  Taylor  gained  one  vote 
in  25  precincts,  two  votes  in  each  of  nine  precincts,  three  votes 
in  each  of  three  precincts,  and  five  votes  in  each  of  two  pre- 
cincts.    These  changes  sum  to  a  loss  of  2  5  votes. 

Goldblatt  lost  one  vote  in  47  precincts,  two  votes  in  each  of 
five  precincts,  three  votes  in  each  of  two  precincts,  four  votes 
in  each  of  two  precincts,  and  five  votes  in  each  of  two  pre- 
cincts. Goldblatt  gained  one  vote  in  41  precincts,  two  votes  in 
each  of  ten  precincts,  three  votes  in  each  of  three  precincts, 
and  twelve  votes  in  one  precinct.  These  changes  result  in  an 
overall  gain  of  one  vote. 

In  addition,  the  number  of  ballots  counted  changed  in  109  of  the 
250  precincts,  for  a  total  loss  of  27  ballots  [51].  Fewer  bal- 
lots were  tallied  in  59  precincts,  while  more  ballots  were  tal- 
lied in  50  precincts.  In  precincts  that  lost  ballots,  one  fewer 
was  counted  in  37  precincts,  two  fewer  in  each  of  eleven  pre- 
cincts, three  fewer  in  each  of  seven  precincts,  four  fewer  in 
each  of  two  precincts,  five  fewer  in  one  precinct,  and  seven  few- 
er in  one  precinct.  In  precincts  that  gained  ballots  counted, 
one  more  was  counted  in  33  precincts,  two  more  in  each  of  13  pre- 
cincts, three  more  in  each  of  two  precincts,  and  four  more  in 
each  of  two  precincts. 

For  the  recount,   data  on  changes  in  precinct  vote  totals  for  the 
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candidates  were  made  available  to  the  public.  However,  the  num- 
ber of  ballots  counted  in  the  recount  in  each  precinct  was  not 
included  in  the  data  released.  The  changes  in  ballots  counted 
that  are  presented  above  are  based  on  data  collected  by  Ms.  Terry 
Elkins,  campaign  manager  for  Max  Goldblatt.  Ms.  Elkins  was  pres- 
ent at  the  recount,  and  copied  down  the  number  of  ballots  tallied 
for  each  precinct. 

The  causes  of  the  changes  in  ballots  and  votes  counted  are  not 
clear.  However,  changes  occurred  in  such  a  manner  as  to  yield 
both  positive  and  negative  values  in  approximately  equal  amounts, 
and  the  number  of  precincts  in  which  changes  occurred  tended  to 
decrease  as  the  value  of  the  change  became  more  severe.  This 
situation  suggests  a  problem  of  system  inaccuracy,  rather  than  of 
deliberate  bias.  This  inaccuracy  could  be  of  either  human  or 
mechanical  origin,  or  both. 

When  numbers  of  votes  change  in  a  system  using  pre-scored  punch 
cards,  the  problem  is  often  ascribed  to  hanging  chad,  although 
failure  of  the  card  readers  to  read  the  cards  accurately  is  a 
reasonable  possibility.  If  the  problem  is  said  to  be  due  to 
chad,  the  explanation  is  that  a  hanging  chad  may  fall  out,  creat- 
ing either  a  vote  or  an  overvote;  or,  a  hanging  chad  may  be 
pressed  back  into  place,  usually  eliminating  a  vote. 

The  cause  of  changes  in  ballots  counted  is  more  perplexing.  In 
the  system  used  in  Dallas,  ballots  were  hand-fed  into  the  card 
readers  one  at  a  time,  by  both  the  voters  and  the  recounters. 
Consequently,  it  is  unlikely  that,  on  several  occasions,  two 
cards  were  fed  at  one  time  and  counted  as  one.  However,  the 
system  used  at  the  precincts  by  voters  required  each  voter  to 
handle  his  or  her  ballot  twice.  First,  the  voter  fed  the  ballot 
into  the  precinct  ballot  computer.  Assuming  that  the  computer 
accepted  the  ballot,  the  voter  was  then  supposed  to  retrieve  the 
ballot  from  the  output  of  the  computer  and  drop  it  into  a  ballot 
box.  In  some  cases,  a  voter  may  have  put  the  ballot  into  the 
ballot  box  without  first  having  fed  the  ballot  through  the  com- 
puter, or  conversely,  the  voter  may  have  fed  the  ballot  through 
the  computer  more  than  once.  On  the  other  hand,  inaccurate  card 
counting  by  the  machines,  due  to  card  jams,  is  a  possibility. 
Only  a  thorough  audit  of  voter  sign-in  lists,  compared  with  an 
accurate  count  of  numbers  of  ballot  cards  delivered  from  the 
precincts  to  the  election  headquarters  could  provide  a  more  con- 
fident basis  for  a  statement  of  the  cause  of  the  identified  bal- 
lot count  discrepancies. 

In  September,  1986,  Ms.  Elkins  concerns  about  the  election  were 
publicized.  These  concerns  included  matters  other  than  the  dif- 
ferences between  the  original  count  and  the  recount,  as  discussed 
above.  Instead,  a  major  aspect  of  the  information  provided  by 
Ms.  Elkins  at  that  time  concerned  the  total  number  of  ballots 
cast   for   Mayor.      She   noted   that   the    "Combined  Canvass  Report" 
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produced  by  the  Dallas  County  Election  Department  on  the  evening 
of  April  6  stated  on  page  14  that  there  were  78,398  ballots  cast, 
while  the  same  document  stated  on  page  27  that  there  were  80,208 
ballots  cast.  Furthermore,  the  "Official  Cumulative  Report" 
(which  serves  as  an  overvote-undervote  report) ,  produced  by  the 
Election  Administration  on  April  8,  stated  that  there  were  79,783 
ballots  cast.  Ms.  Elkins  contended  that  documentation  that  she 
had  gathered  supported  none  of  these  numbers  of  total  ballots 
cast. 

Ms.  Elkins  also  noted  another  apparent  discrepancy  in  the  results 
reported  for  a  City  Council  seat.  In  that  situation  (District 
7),  the  number  of  votes  tallied  was  reported  to  be  10,365.  This 
value  exceeded  the  number  of  ballots  reported  to  be  cast,  9,67  9. 
In  addition,  in  one  precinct,  the  initial  number  of  ballots  cast, 
263,  was  replaced  later  with  another  value,  515.  These  technical 
concerns  of  Ms.  Elkins  were  supplemented  by  concerns  that  the  re- 
sults presented  on  the  computer  printouts  were  created  indepen- 
dently of  the  actual  totals  of  the  voted  ballots  through  a  deli- 
berate attempt  to  subvert  the  outcome.  [52] 

As  a  result  of  Ms.  Elkins'  complaints,  it  was  reported  that  At- 
torney General  Jim  Mattox  and  Secretary  of  State  Myra  McDaniel 
began  investigations  into  voting  discrepancies.  According  to  the 
Dallas  Morning  News  of  Sept.  23,  1986,  "the  probe  centers  on  al- 
legations that  computerized  voting  equipment  and  computer  pro- 
grams used  to  tabulate  state  and  local  elections  may  have  been 
tampered  with  to  bring  about  "preprogrammed'  results."  [53] 

In  that  same  newspaper  article,  Ms.  Elkins  was  quoted  as  saying 
that  "the  allegation  is  that  the  computer  used  to  count  the  votes 
was  given  new  instructions  after  it  calculated  that  Max  Goldblatt 
was  leading  Starke  Taylor  by  400  votes."  Ms.  Elkins  has  noted 
that  the  Dallas  County  computer  had  encountered  difficulties 
shortly  after  8  p.m.  on  election  night,  and  that  the  candidate 
who  was  leading  at  8  p.m.,  prior  to  the  computer  difficulties, 
was  not  leading  when  the  computer  reported  again. 

Ms.  Conny  McCormack,  Dallas  County  Elections  Administrator,  ad- 
mitted that  the  documentation  for  the  April  6,  1985  election 
could  appear  contradictory.  Her  explanation  was  that  the  diffi- 
culty concerned  the  treatment  of  "split  precincts,"  that  is, 
those  precincts  bisected  by  the  Dallas  city  boundary.  There  were 
11  such  split  precincts.  The  value  of  78,398  for  ballots  cast 
was  produced  by  assuming  zero  ballots  cast  from  these  split  pre- 
cincts. The  value  of  80,208  for  ballots  cast  was  produced  by 
adding  the  total  ballots  from  the  split  precincts,  including 
ballots  cast  outside  of  the  city.  The  final  value  of  79,783  for 
ballots  cast  included  only  those  ballots  cast  within  the  city  of 
Dallas.  Ms.  McCormack  contended  that  the  recount  generally  con- 
firmed the  correctness  of  the  originally  reported  outcome.  [54] 
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Ms.  McCormack's  explanation  of  the  problem  of  reporting  split 
precincts  was  supported  by  the  vendor  of  the  vote-tallying  sys- 
tem. In  a  memorandum  on  the  subject,  a  vendor  representative 
stated  that  there  was  a  difference  between  the  type  of  reports 
requested  by  Dallas  County  Elections  Department  for  the  PBCs 
(precinct  ballot  counters)  and  for  the  central  computer.  The 
central  computer  was  used  to  accumulate  totals  reported  by  the 
PBCs.  The  coding  for  the  central  computer  included  provision  for 
split  precinct  specification  of  ballots  cast^  but  the  coding  for 
the  PBCs  did  not  allow  for  this.  According  to  the  vendor,  "this 
extra  statistical  option  was  not  requested  by  Dallas  for  that 
election."  [55] 

The  vendor  representative  further  stated,   in  the  same  memo,  that: 

"Since  the  [data]  packs  did  not  have  this  [split  pre- 
cinct] information  to  transmit,  all  of  the  precincts 
which  were  transmitted  had  a  "zero  ballots  cast"  for 
the  districts.  Again,  total  ballots  cast  and  all  can- 
didate votes  were  present  and  correct. 

"On  the  cumulative  report,  then,  the  votes  received  by 
the  district  candidates  were  much  greater  than  the  bal- 
lots cast  figures  for  those  districts.  Although  the 
explanation  for  this  apparent  anomaly  is  now  clear,  it 
clearly  was  a  suspicious  looking  situation." 

With  regard  to  the  change  in  ballot  totals  reported  for  one  pre- 
cinct, Ms.  McCormack  stated  that  this  was  due  to  a  failure  of  a 
PBC  data  pack.  This  occurs  about  2%  to  4%  of  the  time,  she  stat- 
ed.    The  procedure  when  this  happens  is  as  follows: 

"When  [a  failure  of  a  PBC  data  pack]  occurs,  the  actual 
ballot  cards  are  counted  at  the  central  counting  sta- 
tion. Such  discrepancies  from  PBC  tape  to  actual  bal- 
lots cast  is  determined  by  examination  of  the  specific 
Ballot  and  Seal  Certificates.  When  there  is  a  discrep- 
ancy between  number  of  persons  signing  the  signature 
roster  at  the  precinct  and  the  number  of  ballots  cast 
according  to  the  PBC  tape,  then  the  ballots  from  that 
precinct  are  counted  centrally."  [54] 

A  summary  of  the  ballots  cast  in  this  election,  as  officially 
reported,  is  shown  below,  by  district.  It  can  be  seen  from  the 
table  that  the  largest  component  of  ballots  from  split  precincts 
occurs  in  District  7,  where  the  increase  from  Column  A  to  Column 
B  is  1,661.  However,  422  of  these  ballots  were  from  outside  the 
city,  so  that  the  total  number  of  ballots  cast  in  District  7  in- 
side the  city  is  10,918.  The  latter  number  is  shown  in  Column  C, 
and  it  is  appropriately  higher  than  the  total  votes  for  candi- 
dates in  District  7,  which  was  10,365.  [56] 


62 


District 


(A) 

Excluding 

Split 
Precincts 


(B) 

Including  All 
Ballots  From 
Split  Precincts 


(C) 

Only  Ballots 
Cast  in  City 


1 
2 
3 
4 
5 
6 
7 
8 


9371 
6314 
16351 
14529 
13088 
4118 
9679 
4948 
78398 


9395 

6314 
16382 
14529 
13088 

4118 
11340 

5042 
80208 


9392 

6314 
16382 
14529 
13088 

4118 
10918 

5042 
79783 


Totals 


Certain  technical  problems  raised  by  Ms.  Elkins  seem  to  have  been 
given  a  credible  explanation,  on  the  basis  of  information  made 
publicly  available  in  late  1986.  However,  as  Warner  Croft  stated 
in  his  testimony  to  the  Texas  House  of  Representatives  Committee 
on  Elections: 

"There  is  an  audit  trail  but  there  are  holes  in  it. 
The  audit  trail  should  consist  of  everything  from  the 
ballots  themselves  to  the  console  log  being  printed  by 
the  computer  on  election  night.  The  present  laws  don't 
identify  what  the  minimum  requirements  are,  so  that, 
with  the  absence  of  a  minimum  definition,  it  just  does 
not  exist.  You  go  after  these  things,  and  the  laws 
don't  require  that  they  be  kept  on  file  now,  so  they 
have  been  destroyed  months  ago.  So  you  really  couldn't 
tell  if  there  was  fact  to  these  allegations  are  not. 
That  has  been  one  of  our  problems.  Records  aren't 
available;  there  are  no  auditable  results."  [22] 

Ms.  Elkins'  charges  that  the  results  were  "preprogrammed"  inde- 
pendently of  the  actual  votes  cast  were  not  put  to  rest  in  1986. 
In  March,  1987,  the  Texas  Attorney-General's  office  asked  the 
District  Attorney  of  Dallas  County  to  assist  in  reviewing  the 
election  complaints.  The  review  concerned  "the  reliability  of 
Dallas  County's  computerized  election  system  and  whether  the 
equipment  is  vulnerable  to  fraud  through  subtle  changes  in  com- 
puter programs."  [57] 

On  October  14,  1987,  the  office  of  the  District  Attorney  of  Dal- 
las County  replied  to  the  Texas  Attorney  General's  Office  with  a 
letter  [58]   including  the  following: 

"We  have  carefully  considered  each  of  the  thirteen  (13) 
"discrepancies"  discussed  in  the  report  [submitted  by 
your  office]  ,  and  .  .  .  each  of  the  "discrepancies"  has 
been  explained  to  our  satisfaction;  and  although  we 
verified  that  a  few  coding  errors  were  in  fact  made,  we 
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have  concluded  that  they  were  the  result  of  uninten- 
tional "human  error."  We  find  no  evidence  whatsoever 
to  indicate  any  deliberate  fraud  in  the  1985  election, 
nor  do  we  find  any  credible  evidence  to  indicate  an  at- 
tempt to  manipulate  the  election  or  its  outcome  by  any- 
one, be  it  candidate,  election  official,   or  vendor." 

Some  knowledgeable  persons  have  found  this  statement  puzzling,  in 
view  of  Warner  Croft's  testimony  that  necessary  documents  consti- 
tuting the  audit  trail  had  been  previously  destroyed. 

In  the  April,  1987,  mayoralty  election,  split  precincts  were 
eliminated  by  the  Dallas  County  Election  Administration.  Pre- 
cincts that  had  been  bisected  by  the  Dallas  city  boundary  or  City 
Council  district  boundary  were  divided  into  two  or  more  separate 
precincts.  Letters  A  and  B,  added  to  the  precinct  identifier, 
were  used  to  distinguish  the  formerly  combined  precincts,  as  in 
1193A  and  1193B. 

4 . 4  Elkhart  County,   Indiana:  November.   1982  And  November,  1986 
4.4.1  November,   1982  General  Election 

Elkhart  is  a  county  of  about  140,000  population  on  the  northern 
border  of  Indiana,  located  about  90  miles  east  of  Chicago.  In 
lawsuits  filed  in  state  and  Federal  courts,  several  losing  candi- 
dates alleged  that  election  fraud  occurred  in  the  administration 
of  the  general  election  of  November  2,  1982. 

In  this  election,  the  computer  facilities  of  a  bank  located  in 
the  county  seat  of  Goshen  were  used  for  ballot-counting  purposes. 
The  office  of  the  county  clerk  had  limited  computer  expertise  for 
carrying  out  its  responsibilities  for  management  of  the  ballot- 
counting  process.  Technical  operations  related  to  computer  pro- 
cessing of  the  ballots  were  undertaken  by  bank  employees  and  by 
an  employee  of  the  vendor  of  the  vote-counting  software.  The 
bank's  computer  was  capable  of  multiprogramming,  and  bank  opera- 
tions continued  during  ballot  counting. 

It  is  important  to  note  at  this  point  that  punch  card  ballots  in 
a  general  election  in  Indiana  have  "straight  party"  punch  loca- 
tions. A  voter  who  votes  one  (and  only  one)  of  these  punch  loca- 
tions automatically  votes  for  all  candidates  of  that  party  unless 
the  voter  specifically  votes  for  a  candidate  of  another  party  in 
a  particular  contest.  A  vote  in  a  particular  contest  always 
overrides  the  straight  party  vote.  This  feature  of  Indiana  bal- 
lots figures  prominently  in  this  situation. 

Procedural  and  computer-related  errors  in  the  election  affected 
at  least  three  contests.  The  errors  concerned  votes  for  the  Town 
Board  of  Wakarusa  (a  town  within  Elkhart  County) ,  votes  for  Dis- 
tricts 2  and  3  of  the  County  Council,   and  votes  for  a  State  Rep- 
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resentative  contest. 


The  boundaries  of  the  town  of  Wakarusa  are  wholly  within  Olive 
Township  of  Elkhart  County.  Some  of  the  voters  in  this  township 
live  within  Wakarusa,  and  some  live  outside  the  town.  Only  those 
residing  within  Wakarusa  are  entitled  to  vote  for  the  Town  Board. 
However,  no  arrangements  were  made  to  distinguish  town  residents 
from  non-residents  for  purposes  of  casting  ballots.  All  voters 
in  the  township  were  given  the  same  ballot.  The  result  of  not 
separating  ballots  of  residents  and  non-residents  was  that  Town 
Board  candidates  received  more  votes  than  they  were  entitled  to 
obtain.  The  extra  votes  were  from  voters  residing  outside  the 
town,  and  these  consisted  primarily  of  straight  party  votes  that 
were  assigned  by  the  vote-tallying  computer  program  to  Town  Board 
candidates  as  well  as  to  other  candidates  on  the  ballot.  In  ad- 
dition, there  may  have  been  votes  for  individual  Town  Board  can- 
didates by  non-resident  voters  who  mistakenly  voted  for  them. 

The  Wakarusa  problem  was  not  discovered  until  several  days  after 
the  results  were  certified,  when  an  election  worker  realized  that 
the  total  number  of  votes  for  Town  Board  candidates  was  much 
higher  than  that  number  of  votes  which  could  have  been  cast  by 
voters  entitled  to  vote  for  Town  Board.  The  problem  was  "solved" 
by  an  informal  agreement  approved  by  the  Election  Board  under 
which  all  straight  party  votes  were  eliminated  for  Town  Board 
candidates.  This  "solution"  disenfranchised  those  voters  within 
the  town  who  lawfully  cast  straight  party  votes.  The  change 
overturned  one  outcome,  but  the  loser  was  dissuaded  from  suing. 
According  to  Elkhart  attorney  David  T.  Stutsman,  the  agreement  to 
change  the  outcome  was  in  violation  of  Indiana  law,  and  a  legally 
correct  solution  would  have  been  to  hold  a  new  Town  Board  elec- 
tion. 

In  the  counting  of  votes  for  County  Council,  votes  for  candidates 
in  Districts  2  and  3  were  interchanged.  This  situation  became 
apparent  to  one  of  the  Election  Board  members  when  Higgins,  the 
unopposed  candidate  in  District  3,  was  initially  shown  to  have  a 
significant  number  of  opposing  votes.  In  addition,  Barnes,  the 
incumbent  in  District  2,  was  getting  almost  no  votes,  while  Wie- 
denhoeft,  Barnes'  novice  opponent,  was  winning  a  large  majority. 
This  unexpected  condition  was  pointed  out,  and  the  interchange 
was  discovered.  The  error  was  corrected  by  changes  in  control 
cards  that  were  carried  out  by  an  employee  of  the  software  ven- 
dor. This  latter  individual  had  been  sent  from  another  state  by 
the  software  vendor  for  the  sole  purpose  of  assisting  in  ballot- 
counting  operations.  He  appeared  for  the  first  time  on  the  af- 
ternoon of  the  election,  and  returned  to  his  home  state  immedi- 
ately following  the  completion  of  the  computerized  vote-tallying. 

In  the  contest  for  State  Representative,  it  become  apparent  late 
in  the  evening  of  November  2  that  an  incorrect  punch  position  was 
being  used  to  tally  votes   for  one  of  the  candidates,    Philip  T. 
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Warner,  in  his  race  against  Mike  Puro.  The  software  vendor's  em- 
ployee again  changed  some  control  cards,  and  a  retabulation  was 
undertaken.  The  retabulation  resulted  in  a  significant  change  in 
vote  totals:  an  increase  of  3,710  for  Warner  and  a  decrease  of  53 
votes  for  Puro.  The  reason  that  there  was  a  decrease  in  Puro '  s 
totals  was  because  of  individual  votes  for  Warner  by  voters  who 
had  also  indicated  a  straight  party  punch  for  Puro's  party.  Be- 
fore Warner's  votes  were  properly  tabulated,  the  straight  party 
punches  had  added  to  Puro's  total,  but  the  specific  votes  for 
Warner  on  the  same  ballots  negated  these  straight  party  votes. 

It  seems  clear,  from  the  Wakarusa  situation,  that  the  full  impli- 
cations of  computer  processing  of  ballots  were  not  completely  ap- 
preciated by  the  persons  responsible  for  running  the  election: 
the  Election  Board  and  its  employees.  In  addition,  it  seems 
clear,  also,  from  the  tabulating  errors  in  the  County  Council  and 
State  Representative  contests,  that  insufficient  attention  was 
paid  by  those  responsible  for  running  the  election  to  examination 
of  the  "edit  list"  that  identifies,  for  the  computer,  the  assign- 
ment of  punch  locations  to  candidates.  Adequate  testing  of  the 
computer  system  prior  to  use  appeared  to  be  lacking,  possibly  to 
an  extent  inconsistent  with  Indiana  law. 

The  alleged  misfeasances  have  been  described  in  lawsuit  briefs 
filed  by  the  losing  candidates,  and  documentation  on  the  charges 
has  been  obtained  from  David  T.  Stutsman,  their  attorney.  A 
major  source  of  problems  in  the  election  was  the  apparent  failure 
to  properly  test  the  equipment  prior  to  use.  The  losing  candi- 
dates charged  that  no  test  of  the  automatic  tabulating  equipment 
was  undertaken  five  days  prior  to  the  election,  as  required  by 
the  Indiana  statute  then  in  effect,  and  that  only  a  superficial 
test  was  done  at  about  4  p.m.  on  election  day. 

According  to  Mr.  Stutsman,  this  test  on  election  day  consisted  of 
a  count  of  just  13  test  ballots  each  for  only  two  precincts  of 
the  63  precincts  involved  in  the  election.  As  a  result  of  a  law- 
suit concerning  this  election,  an  alleged  configuration  of  these 
13  cards  and  the  results  that  they  generated  on  the  computer  have 
now  come  to  light.  According  to  this  information,  the  test  bal- 
lots should  have  generated  three  lawful  votes  for  the  Democratic 
senate  candidate,  but  instead  they  generated  four  such  votes. 
One  test  ballot  that  should  not  have  produced  a  vote  contained  a 
straight  Democratic  punch,  and  individual  punches  for  both  Demo- 
cratic and  Republican  senate  candidates.  A  second  test  ballot 
that  should  not  have  produced  a  vote  contained  straight  party 
punches  for  both  the  Democratic  and  Republican  parties,  that  is, 
an  uncountable  straight  party  overvote.  One  of  these  test  bal- 
lots probably  supplied  the  incorrect  fourth  test  vote.  If  this 
information  about  the  test  ballots  and  results  is  correct,  the 
ballot  counting  process  on  November  2,  1982  should  not  have  pro- 
ceeded until  the  logical  error  was  corrected.  As  stated  in  the 
Indiana  statute  I.C.   3-2-4-4 (f)   in  force  at  the  time: 
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"If  any  error  is  detected  [in  the  test],  the  cause 
therefor  shall  be  ascertained  and  corrected  and  an  er- 
rorless count  shall  be  made  before  the  automatic  tabu- 
lating equipment  is  approved." 

Other  errors  in  administration  that  have  been  alleged  were  that 
the  changes  in  the  control  cards  that  were  made  were  not  accom- 
panied by  system  tests,  that  the  computer  systems ' s  clock  was 
disabled  (thereby  preventing  times  of  console  actions  from  being 
reported) ,  and  that  no  precinct  numbers  were  printed  on  the  bal- 
lot cards. 

Computer  consultants  hired  by  the  losing  candidates  submitted 
statements  including  the  following: 

"The  Edit  List  was  not  correct  when  the  program  was 
initiated. . . .  Thorough  tests  would  have  caught  these 
irregularities . 

"Given  the  nature  of  the  undocumented  program  correc- 
tion ...  it  is  impossible  to  know  exactly  how  the  the 
program  tallied  the  votes.  The  control  log  shows  no 
test  of  accuracy  after  the  [vendor's]  representative 
modified  the  parameter  cards. 

"The  lack  of  a  clear  audit  trail  and  the  lack  of  error 
reports,  the  convoluted  code  reports  plagued  with  er- 
rors, and  the  unquestioned  trust  in  an  untested  elec- 
tronic process  seems  to  be  a  major  problem  with  this 
system  comprised  of  hardware,   software,   and  users. 

"In  the  opinion  of  [the  computer  consultants,]  it  would 
be  possible  to  modify  program  logic  with  the  use  of  in- 
serted control  cards.  It  would  be  possible  to  change 
accumulated  vote  totals  by  reading  in  control  cards  at 
the  appropriate  time  during  the  program  execution. 
This  would  be  unknown  to  the  election  officials  or  any- 
one but  an  experienced  operator.  This  program  uses  al- 
ter verbs  which  allows  program  logic  changes  with  the 
use  of  control  cards  inserted  at  execution  time. 

"A  knowledgeable  operator  can  change  the  program  logic 
in  execution  with  insertion  of  control  cards  .  .  .  many 
possibilities  for  change  in  program  logic  and  vote 
tally  exists."  [59] 

The  losing  candidates'  case,  brought  before  the  U.S.  District 
Court  for  the  Northern  District  of  Indiana,  named  the  local  board 
officials  as  defendants.  It  was  alleged  in  the  pleadings  in  that 
case  that  the  computer  system  was  not  tested,  that  there  was  no 
error-free    test    of    the   system   before   the   official    count,  that 
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there  was  no  actual  count  of  the  ballots  and  that  the  alleged 
count  and  certification  of  the  vote  count  was  fraudulent.  The 
pleadings  and  briefs  further  stated  that  the  control  cards  for 
the  operation  of  the  program  were  altered  by  the  vendor  represen- 
tative during  the  counting,  and  that  the  acts  by  the  election  of- 
ficials were  willful,  wanton,  reckless  and  oppressive. 

However,  the  court  entered  a  summary  judgment  on  Feb.  21,  1985 
against  the  losing  candidates  because,  in  the  court's  opinion, 
there  were  no  allegations  of  any  "willful  conduct  which  under- 
mines the  organic  processes  by  which  candidates  are  elected" 
(language  of  an  important  precedent,  Hennings  v.  Grafton)  [60]. 
The  judgment  of  the  lower  court  was  affirmed  by  the  U.S.  Court  of 
Appeals  for  the  Seventh  Circuit,  which  stated  that  "the  appel- 
lants (i.e.,  the  losing  candidates)  confuse  fraud  with  what  is  at 
most  willful  neglect."  [61]  Mr.  Stutsman  notes  that  the  plain- 
tiffs were  not  allowed  to  present  their  evidence  in  the  case. 
The  lawsuit  was  dismissed  as  a  matter  of  law,  without  a  trial  on 
the  merits.     Therefore,   a  jury  was  not  allowed  to  hear  the  case. 

A  second  Federal  lawsuit,  filed  in  the  Southern  District  of  In- 
diana, continues  to  be  pending,  with  the  vendor  named  by  the  New 
York  Times  as  the  principal  defendant.  This  suit  charges  negli- 
gence, breach  of  contract,  and  strict  liability,  alleging  that 
the  computer  system  used  in  the  election  was  sold  in  a  defective 
condition  and  caused  loss  and  damage  to  the  losing  candidates. 
In  addition,  it  is  alleged  that  the  vote  counting  was  a  fraud  and 
that  the  certification  of  the  vote  totals  was  false  and  fraudu- 
lent. 

4.4.2  November,   1986  General  Election 

Following  the  1986  general  election,  a  State-mandated  recount  was 
undertaken  that  included  ballots  from  Elkhart  County.  In  this 
recount,  directed  by  Dean  David  Link  of  the  Notre  Dame  Law 
School,  it  was  discovered  that  the  computer  program  used  to  count 
ballots  in  Elkhart  County  was  not  counting  correctly  according  to 
Indiana  law.  The  problem  occurred  in  the  treatment  of  ballots 
that  were  overvoted  in  the  "straight  party"  positions.  According 
to  Indiana  law,  these  ballots  should  be  voided  for  all  partisan 
contests.  Instead,  the  ballots  had  been  counted  in  the  contest 
being  recounted.     These  ballots  were  eliminated  in  the  recount. 

4 . 5  Gwinnett  County,  Georgia:  November,  1986 

A  recount  undertaken  in  a  State  Senate  race  showed  the  loser  in 
the  first  count  winning  the  contest  by  77  votes.  The  original 
tally  had  given  challenger  Steve  Pate  a  winning  margin  of  eight 
votes.  However,  the  recount  gave  incumbent  Donn  Peevy  13,682  to 
Pate's  13,605.  According  to  an  article  in  the  Atlanta  Constitu- 
tion ,  November  13,  1986,  "the  recount  was  the  result  of  a  com- 
puter  hardware   error    .  .  .    affecting  hundreds   of  uncounted  votes 
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..."  [62]  The  "computer  hardware  error"  in  question  was  believed 
to  be  a  problem  with  the  card  readers  that  read  the  pre-scored 
punch  card  ballots. 

Allegations  raised  in  this  election  included  charges  of  "hidden 
ballots."  It  appears  that  a  box  of  ballots  and  documents  re- 
ceived from  one  precinct  was  initially  believed  to  consist  of  the 
complete  set  of  voted  ballots  on  top  of  other  documents  in  the 
box.  When  the  documents  were  removed  from  the  box  after  the  bal- 
lots on  top  had  been  counted,  more  ballots  were  found  under  the 
documents.  In  addition,  it  was  "charged  that  ballots  from  two 
precincts  did  not  arrive  at  the  elections  office  until  early  on 
the  morning  of  Nov,  5  [the  day  after  the  election]  in  the  car  of 
the  elections  board  member,"  according  to  the  article  in  the  Con- 
stitution. 

The  original  count  was  undertaken  on  a  system  consisting  of  two 
personal  computers,  each  with  a  card  reader,  networked  together 
to  drive  one  printer.  For  the  recount,  it  was  agreed  to  separate 
the  two  computers  and  to  count  the  ballots  twice,  once  on  each 
computer.  Unfortunately,  the  recounts  obtained  from  the  two  com- 
puters were  slightly  different,  although  not  of  a  difference  suf- 
ficiently large  to  overturn  any  contest. 

The  Georgia  Tech  Research  Institute  (GTRI)  was  asked  by  the  of- 
fice of  the  Secretary  of  State  of  Georgia  to  render  any  possible 
assistance.  GTRI  decided  to  review  the  situation  and  to  deter- 
mine the  source  the  discrepancies  between  the  two  computer  out- 
puts. The  investigatory  team,  headed  by  Dr.  Britain  Williams, 
hoped  to  separate  the  causes  of  the  errors  into  at  least  two 
classes:  those  caused  by  handling  of  the  ballots  by  voters  and 
voting  officials,  and  those  caused  by  the  hardware.  According  to 
Williams,  "everything  that  could  have  been  done  to  insure  the  ac- 
curacy of  the  recount  was,  in  fact,  done  and  the  discrepancies 
observed  are  inherent  in  this  type  of  system.  A  thorough  analy- 
sis of  these  results  will  be  conducted  in  an  attempt  to  estimate 
the  inherent  error  in  using  pre-scored  ballots."  [63] 

A  report  has  now  been  produced  by  Williams  and  an  associate. 
[106]  The  report  compares  differences  in  the  results  in  three 
counts:  the  general  election,  and  the  recounts  on  the  two  indi- 
vidual machines.     The  report  states  that: 

"Errors  were  either  tabs  which  were  not  yet  dislocated 
from  their  pre-punched  positions  in  the  ballot,  or 
stray  tabs  which  filled  other  previously  punched-out 
positions  (+  and  -  errors)." 

According  to  the  report,  errors  were  caused  by  such  factors  as 
handling  procedures,  the  ballot  puncher  (which  was  of  the  "voto- 
matic"  type),  the  vote  counter,  the  punched  card's  density,  vote 
position  on  the  ballot  card,   human  error,   and  pure  chance.  The 
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report  concludes  that: 


"...there  should  be  a  system  set  up  to  make  the  voters 
and  especially  the  volunteer  workers  aware  of  the  ef- 
fects procedural  care  has  on  the  accuracy  of  tabula- 
tions (since  this  was  where  the  main  problem  was  dis- 
covered) .  Details  like  not  putting  large  (or  any)  rub- 
ber-bands around  the  ballots  would  also  be  advisable 
(especially  since  custom  ballot  carriers  are  provid- 
ed) .  " 

4.6  Illinois  -  Statewide  Testing  Program 

The  Illinois  State  Board  of  Elections,  Division  of  Voting  Sys- 
tems, under  the  direction  of  Michael  L.  Harty,  (now  Director  of 
Elections,  Maricopa  County,  Arizona)  has  undertaken  tests  of 
vote-counting  computer  systems.  Between  1983  and  1987,  the  divi- 
sion conducted  48  tests  of  the  automatic  tabulating  equipment  and 
computer  programs  in  41  election  jurisdictions.  The  tests  have 
involved  anywhere  from  1,000  to  65,000  test  ballots.  The  divi- 
sion found  apparent  computer  program  tabulation  errors  in  11  of 
the  election  jurisdictions  tested.  The  division  reports  that 
most  of  these  errors  would  not  have  been  discovered  without  ade- 
quate testing.  As  a  result  of  its  testing  experiences,  the  Divi- 
sion of  Voting  Systems  has  concluded  in  its  Summary  of  Findings 
and  Observations  on  State  Board  of  Elections  Computer  Testing 
Program,   revised  February,   1987:  [64] 

"The  testing  of  computer  vote  tabulation  systems  needs 
to  be  improved  substantially.  At  a  minimum,  voting 
systems  tests  must  be  large;  must  test  all  voting  posi- 
tions; must  test  overvotes  and  undervotes;  column  bina- 
ry punches;  straight  and  split  party  votes;  nonvoting 
position  punches;  and  must  test  for  every  candidate  in 
every  ballot  configuration  in  every  precinct.  Only  by 
extensive  testing  of  a  computer  vote  tabulation  system 
can  we  be  reasonably  assured  that  tabulation  of  the 
ballots  will  be  entirely  accurate". 

The  following  descriptions  of  programming,  program  initializa- 
tion, and  hardware  problems  in  local  jurisdictions  in  Illinois 
are  taken  from  the  reference  given  above. 

4.6.1  Programming  and/or  Program  Initialization  Errors 

Whiteside  County  -  1986  General  Primary  Election:  The  system 
tabulated  votes  on  ballots  that  contained  invalid  security  codes 
(ballot  style  identifiers) . 

Morgan  Countv  -  1985  Consolidated  Election:  No  straight  party 
votes  registered  for  the  candidates  of  a  party.  However,  this 
did  not  affect  the  individual  candidate  totals. 


70 


Peoria  County  -  1985  Consolidated  Election:  The  computer  program 
misassigned  straight  party  punches  for  a  candidate  for  township 
supervisor.  The  candidate  received  a  tally  from  a  straight  party 
punch  for  the  opposite  party  but  failed  to  receive  a  tally  from 
the  straight  party  punch  of  his  own  party. 

Sangamon  County  -  1985  Consolidated  Election:  The  computer  pro- 
gram would  not  accept  ballots  with  proper  ballot  style  identifi- 
ers. This  error  was  not  discovered  by  the  test  previously  run  by 
the  local  jurisdiction.  In  addition,  ballots  in  precincts  with 
more  than  one  ballot  style  did  not  contain  different  style  iden- 
tifiers. Thus,  it  would  not  have  been  possible  to  separate  the 
voted  ballots  of  the  different  styles. 

Logan  County  -  1985  Consolidated  Primary  Election:  Tabulation 
errors  occurred  when  precincts  were  split  by  ward  boundaries. 
When  the  same  punch  position  was  assigned  to  different  candidates 
in  different  wards  in  the  same  precinct,  votes  for  one  of  the 
candidates  were  not  tallied  by  the  computer  program. 

Effingham  County  --  1984  General  Election:  A  county-level  office 
was  not  being  tabulated  in  five  precincts,  though  votes  were  as- 
signed to  the  office. 

Jackson  County  -  1984  General  Election:  A  translation  error  be- 
tween precinct  returns  and  the  summary  report  caused  the  summary 
report  to  fail  to  properly  reflect  the  precinct  sum  totals  for 
certain  candidates. 

LaSalle  County  -  1984  General  Election:  The  straight  party  vote 
was  not  being  tabulated  for  all  candidates  in  a  party.  In  addi- 
tion, when  an  overvote  occurred  in  the  straight  party  column  and 
also  in  an  individual  candidate's  punches  on  the  same  ballot,  the 
candidates  involved  actually  lost  a  vote,  i.e.,  had  their  vote 
totals  reduced  by  a  vote  (instead  of  simply  being  denied  a  vote) . 

Grundy  County  -  1984  General  Primary  Election:  Forty-seven  per- 
cent of  the  precincts  had  one  or  more  of  the  following  types  of 
errors:  (1)  the  assignment  of  the  wrong  county  board  districts 
in  the  precincts,  (2)  the  deletion  of  candidates  in  precincts, 
(3)  the  incorrect  assignment  of  candidates  to  precincts,  (4)  as- 
signment of  only  1/2  vote  for  each  vote  cast,  and  (5)  incorrect 
totals  of  precinct  votes  on  the  summary  report  for  several  can- 
didates. 

Rock  Island  County  -  1984  General  Primary  Election:  Two  votes 
for  each  vote  cast  were  being  tabulated  for  a  candidate.  In  ad- 
dition, the  "no"  votes  on  a  proposition  were  not  being  counted. 
Further,  the  summary  report  totals  did  not  properly  reflect  pre- 
cinct sum  totals  for  several  candidates. 
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4.6.2  Hardware  and  Punch  Card  Difficulties 

City  of  Chicago  -  1987  Consolidated  General  Election:  The  system 
test  indicated  an  approximate  3%  failure  rate  of  program  chips. 
The  chips  were  improperly  programmed  or  "burned."  The  malfunc- 
tion would  have  been  identified  during  the  public  test. 

Boone  County  -  1987  Consolidated  Primary  Election;  Due  to  sub- 
stantial ballot  quality  defects,  a  system  test  could  not  be  exe- 
cuted.    New  test  ballots  were  ordered. 

Pulaski  County  -  1986  General  Primary  Election;  The  principal 
disk  that  contained  the  vote-tallying  program  failed  to  operate 
for  the  system  test.  The  duplicate  (backup)  disk  was  employed. 
The  principal  disk  operated  correctly  for  the  public  test.  No 
reason  for  the  problem  was  discovered. 

Jackson  County  -  1984  General  Election;  Column  binary  punching 
appeared  to  cause  severe  tabulation  delay.  In  addition,  the 
card  reader  stopped  occasionally  during  the  tabulation  of  a  pre- 
cinct. When  this  condition  occurred,  the  results  already  ob- 
tained had  to  be  erased  and  all  the  ballots  for  the  precinct  had 
to  be  retabulated.  The  cause  of  this  difficulty  could  not  be 
immediately  ascertained. 

Will  County  -  1984  General  Election;  During  the  system  test,  the 
card  reader  was  jammed  twice  by  ballots.  The  ballots  involved 
were  almost  completely  destroyed  in  the  process. 

4 . 7  Maricopa  County^   Arizona;   September,  1986 

A  clerical  error  that  would  have  interchanged  votes  for  the  two 
major  parties  in  this  primary  election  was  caught  during  testing. 
Pre-punches  (ballot  style  identifiers)  were  incorrectly  speci- 
fied, and  if  the  errors  had  not  been  caught,  votes  in  the  primary 
contests  in  each  party  would  have  been  assigned  to  the  other  par- 
ty during  tallying.  Poor  communication  between  the  county  data 
processing  department  and  the  election  administration  contributed 
to  the  problem.  A  well-designed  testing  process  caught  the  er- 
ror, so  that  ballot  counting  during  the  actual  election  was  not 
affected.  [65] 

4 . 8  Moline,  Illinois;  1985  Consolidated  Municipal  and  Township 
Election 

The  following  report  is  primarily  based  on  an  article  in  Illinois 
Issues ,  November,  1985,  that  was  republished  in  a  newsletter  of 
the  National  Center  for  Policy  Alternatives.  [66] 

In  this  election  on  April  2,  1985,  the  failure  of  a  card  reader 
to  read  correctly  caused  a  losing  aldermanic  candidate  for  Moline 
City  Council  to  be  put  into  office.     The  error  was  not  rectified 


72 


until  about  three  months  later. 


The  failure  of  the  card  reader  was  not  initially  apparent.  It 
was  only  discovered  after  defeated  Moline  3rd  Ward  aldermanic 
candidate  Earl  Wendt  went  to  court  to  demand  a  recount.  Wendt 
had  lost  by  two  votes,  and  the  recount  was  ordered  by  Rock  Island 
County  Circuit  Court.  In  the  recount  on  May  14,  Wendt  picked  up 
two  votes,  but  his  opponent  Allen  McCauley  picked  up  92  votes. 
The  large  change  in  McCauley 's  total  demonstrated  that  a  serious 
error  in  vote-tallying  had  occurred.  The  data  showed  that  the 
error  was  in  the  failure  of  the  system  to  tabulate  many  straight 
party  votes  for  McCauley.  Further  investigation  appeared  to  dem- 
onstrate that  the  problem  was  a  slipping  timing  belt  in  one  card 
reader. 

As  a  result  of  the  Wendt-McCauley  recount,  the  party  of  losing 
4th  Ward  aldermanic  candidate  Charles  Reynolds  also  demanded  a 
recount  in  a  petition  to  the  Moline  City  Council.  Reynolds  was 
of  the  same  party  as  McCauley.  However,  the  City  Council  denied 
this  petition  and  two  similar  petitions  from  other  candidates  on 
the  basis  that  the  30  days  following  the  election  allowed  for 
such  petitions  had  expired. 

Following  these  denials,  Dennis  Faust,  assistant  State's  Attorney 
submitted  a  petition  of  quo  warranto  to  Chief  Judge  David  DeDonc- 
ker  of  the  14th  Judicial  Circuit.  The  quo  warranto  petition, 
whose  origin  in  Anglo-American  law  goes  back  to  Edward  I  in  1275, 
is  used  to  remove  "any  person  [who]  shall  usurp,  intrude  into,  or 
unlawfully  hold  or  execute  any  office...",  according  to  the  Illi- 
nois Revised  Statutes.  Faust's  theory  was  that  if  members  of  the 
Moline  City  Council  hadn't  received  a  majority  of  the  votes,  then 
they  held  office  illegally. 

On  July  8,  Judge  DeDoncker  agreed  to  a  recount  for  the  office  of 
city  clerk  and  for  three  aldermanic  offices  including  that  for 
the  4th  Ward,  despite  the  fact  that  the  3  0-day  period  had  ex- 
pired. He  stated  that  there  was  no  knowledge  that  a  machine  was 
not  working  until  40  or  50  days  after  the  election.  "We  had  le- 
gal American  voters  who  voted  and  did  not  get  their  votes  count- 
ed", DeDoncker  said.  The  judge  appointed  representatives  of  the 
vendor  of  the  vote-counting  system  to  serve  as  officers  of  the 
court  and  ordered  them  to  conduct  a  recount.  A  judge  of  a  higher 
court  refused  to  stay  the  recount,  and  it  proceeded. 

As  a  result  of  this  recount,  alderman  Roy  Lear  picked  up  two 
votes,  but  his  opponent  Charles  Reynolds  added  13  5,  making  the 
final  count  557  for  Reynolds  to  473  for  Lear.  Through  a  court 
order,  Lear  was  removed  from  the  city  council.  Reynolds  was 
seated  in  his  place.     Lear  did  not  appeal. 
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4 . 9  Oklahoma  County,  Oklahoma:  November,   198  6 


In  the  general  election  of  November,  1986,  difficulties  perceived 
by  an  independent  group  of  local  observers  involved,  among  other 
items,  the  operability  of  the  precinct-located,  mark-sense  com- 
puters, and  the  anomalous  numbers  of  counted  ballots  that  were 
reported.  These  observers,  David  Clampitt,  Carolyn  Burkes,  and 
Sue  Milton,  submitted  the  data  on  which  the  discussion  below  is 
based. 

The  county  signed  a  contract  to  purchase  the  mark-sense  vote- 
counting  equipment  in  the  summer  of  1984.  The  State  of  Oklahoma 
has  no  system  of  prior  State  approval  of  voting  devices  before 
such  devices  may  be  purchased  by  a  county.  However,  no  county 
may  purchase  a  type  of  voting  device  before  the  State  Board  of 
Elections  has  implemented  rules  of  operation  for  that  type  of  de- 
vice. Four  counties  in  the  State  utilize  mark-sense  type  voting 
devices.  Oklahoma  County  is  the  only  county  of  these  four  uti- 
lizing the  particular  model  in  question. 

Engineering  tests  on  the  particular  devices  purchased  by  Oklahoma 
County  were  not  carried  out  by  the  county  until  November  and  De- 
cember, 1984,  when  the  equipment  was  being  delivered.  A  feature 
of  the  equipment  noted  in  the  tests  was  that  a  certain  number  of 
ballots  were  not  being  processed  (were  being  treated  as  unread- 
able) by  the  machines.  Approximately  1.5%  of  the  ballots  were  so 
treated  by  each  of  the  two  different  units  being  tested.  Accord- 
ing to  the  report,  "non-processed  [ballot]  cards  were  not  visibly 
different  from  those  accepted  and  tabulated,  nor  were  they  always 
the  same  cards  on  successive  runs."  [67] 

The  vote-counting  equipment  was  used  in  a  special  election  at 
about  the  time  of  the  test,  and  the  report  notes  that: 

"The  frequency  of  non-processed  ballots  [5.22%]  was 
observed  in  several  precincts  to  be  significantly 
higher  than  that  observed  during  testing.  This  is 
attributed  to  improper  insertion  of  the  card  by  the 
voter,  namely,  failure  to  insert  the  card  vertically 
and  release  it  cleanly. . . .We  attribute  this  rate  pri- 
marily to  voter  unf amiliarity  with  the  system...." 

The  report  recommended  that: 

"Although  the  [vendor's  equipment]  is  judged  to  comply 
with  all  applicable  statutes  and  regulations, ....  as 
[one  of  four]  desirable  product  improvements,  the  ven- 
dor should  be  encouraged  to  reduce  the  frequency  of 
random  non-processing  of  acceptable  ballots." 

During  the  November  4,  1986  general  election,  the  number  of  non- 
processed   ballots   was   over    2%    in   a   significant   number   of  pre- 
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cincts.  According  to  State  rules,  the  county  Board  of  Elections 
"has  the  authority"  [68]  (but  is  not  required)  to  recount  pre- 
cincts with  over  2%  non-processed  ballots.  The  county  board  has 
used  its  discretion  in  selecting  particular  precincts  for  repro- 
cessing. Reprocessing,  if  done  at  all,  is  done  on  the  county's 
central  computer.  Not  all  precincts  with  over  2%  non-processed 
ballots  were  reprocessed  in  the  November,    1986  general  election. 

Ballots  that  are  not  reprocessed  and  read  by  the  central  computer 
would  never  be  counted  at  all,  except  under  a  court-ordered  man- 
ual recount.  There  are  no  State  or  county  rules  which  would  per- 
mit non-processed  ballots  to  be  counted  manually  in  order  to  have 
the  manual  results  added  to  those  results  already  obtained  by  ma- 
chine. 

Results  of  the  1986  general  election  in  Oklahoma  County  show,  in 
many  cases,  a  lack  of  reconciliation  of  the  number  of  voters 
signed  in  at  each  precinct  with  the  number  of  ballots  cast. 
Table  1  below  demonstrates  that  fact. 


Table  1 


Ballots 

Cast 

Voters 

% 

Pet. 

A 

B 

C 

NP 

Total 

Times  3 

NP 

R 

1 

1036 

1047 

1063 

104 

3250 

3261 

3  .  2 

6 

513 

516 

521 

20 

1570 

1557 

1.3 

R 

10 

389 

396 

400 

48 

1233 

1221 

3.9 

R 

34 

897 

942 

976 

242 

3057 

3003 

7.9 

R 

39 

1014 

1094 

1092 

168 

3368 

3372 

5.0 

59 

370 

374 

381 

47 

1172 

1173 

4  .  0 

61 

37 

38 

38 

4 

117 

117 

3.4 

72 

65 

71 

71 

6 

213 

213 

2  .  8 

82 

708 

722 

775 

350 

2555 

2481 

13.7 

R 

98 

380 

398 

406 

46 

1230 

1284 

3  .  7 

106 

546 

514 

590 

201 

1851 

1857 

10.9 

117 

22 

26 

24 

7 

79 

78 

8  .  9 

R 

122 

870 

1002 

987 

350 

3209 

3126 

10.9 

R 

126 

250 

257 

261 

36 

804 

807 

4  .  5 

131 

10 

11 

11 

0 

32 

33 

0.0 

R 

135 

156 

284 

340 

350 

1130 

1047 

31.0 

R 

136 

104 

107 

109 

7 

327 

327 

2  .  1 

R 

154 

164 

186 

187 

46 

583 

570 

7.9 

R 

159 

663 

861 

905 

489 

2918 

2820 

16.  8 

R 

161 

904 

948 

950 

110 

2912 

2889 

3  .  8 

R 

202 

16 

16 

17 

4 

53 

51 

7  .  5 

208 

116 

121 

123 

14 

374 

375 

3  .  7 

222 

539 

578 

585 

197 

1899 

1857 

10.  4 

R 

256 

249 

258 

266 

29 

802 

807 

3  .  6 

268 

682 

697 

696 

51 

2126 

2154 

2  .  4 

270 

953 

1224 

1319 

703 

4199 

4062 

16.7 

R 

75 


In  this  election,  each  voter  was  given  three  ballot  cards,  desig- 
nated as  A,  B,  and  C.  The  number  of  processed  A,  B,  and  C  ballot 
cards  and  the  number  of  NP  (non-processed)  ballot  cards  are  to- 
talled in  Table  1  for  selected  precincts.  The  total  of  the  bal- 
lots tabulated  (Total  column)  may  be  compared  with  three  times 
the  number  of  voters  signed  in  at  each  precinct  (Voters  Times  3 
column) ,  as  shown  in  the  table.  Values  in  these  two  columns  in 
the  table  for  the  same  precinct  differ  in  most  cases.  According 
to  a  January  25,  1987  article  in  The  Sunday  Oklahoman  entitled 
"Security  of  Elections  Described,"  [69]  "an  examination  of  the 
ballot  accounting  forms  used  in  last  November's  election  in  Ok- 
lahoma County  revealed  that  a  number  of  them  are  neither  filled 
out  nor  signed."  In  addition,  said  the  article,  precinct  voting 
materials  are  not  logged  in  on  a  time  sheet  when  received  at  the 
central  location,  except  for  the  first  and  last  precincts. 

The  "%NP"  column  in  Table  1  indicates  the  percentage  of  non-pro- 
cessed ballots,  over  all  ballots  counted.  The  "R"  column  indi- 
cates whether,  as  a  result  of  the  non-processed  ballots,  the  pre- 
cinct was  recounted  on  the  county's  central  computer.  Several 
precincts  with  significant  percentages  of  non-processed  ballots 
were  not  recounted,  at  the  discretion  of  the  County  Election 
Board. 

In  most  of  the  precincts  identified  in  Table  1  that  were  recount- 
ed, the  total  number  of  ballots  counted  exceeds  the  three  times 
the  number  of  voters.  From  this  situation,  it  may  be  inferred 
that  the  recounting  of  non-processed  ballots  (sometimes  up  to 
four  times  in  an  effort  to  get  them  to  be  read)  was  not  properly 
accounted,  and  repetitive  attempts  at  reading  added  incorrectly 
to  the  total  number  of  ballots.  The  failure  to  match  totals  of 
ballots  fed  into  the  machines  against  voters  signed  in  calls  into 
question  the  reported  individual  candidate  totals,  as  no  proper 
cross-foot  total  can  be  obtained. 

The  failure  of  proper  accounting  naturally  raises  the  issue  of  a 
manual  recount.  Although  there  was  no  request  for  a  manual  re- 
count in  this  election,  there  have  been  such  requests  in  other 
elections  in  Oklahoma  County.  It  has  been  the  position  of  the 
Oklahoma  County  Election  Board  that  State  law,  until  recently, 
did  not  allow  manual  recounting,  since  the  Board's  interpretation 
of  State  law  is  that  the  same  system  that  was  used  for  the  origi- 
nal count  must  be  used  for  recounting.  However,  this  interpreta- 
tion has  been  continually  challenged  in  the  courts  and  has  been 
overturned.  There  have  been  manual  recounts  in  Oklahoma  County, 
over  the  protestations  of  the  Election  Board.  In  the  most  recent 
session  of  the  State  legislature,  a  law  was  passed  allowing  a  re- 
count petitioner  to  select  either  a  manual  recount  or  a  machine 
recount,   in  those  counties  that  use  vote-tallying  devices. 

In  addition,   during  the  November  4,   1986,   general  election,  over 
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one-third  of  the  273  voting  machines  used  in  the  election  failed 
in  some  manner,  some  more  than  once.  The  most  prevalent  type  of 
failure  was  that  the  machine  simply  stopped  accepting  ballots. 
[70] 

Another  anomaly  of  the  reported  results  of  this  election  in  Okla- 
homa County  is  that  the  lower-level  offices  and  obscure  State 
questions  on  the  ballot  appeared  to  be  as  popular  with  voters  as 
the  office  of  governor.  That  is,  the  traditional  "fall  off"  of 
voter  interest  in  the  lower-level  offices  and  State  questions  did 
not  occur,  at  least  according  to  the  reported  results. 

This  condition  is  shown  in  Table  2  below.  The  votes  for  the  of- 
fices of  governor.  State  representative,  and  on  State  question 
#589  are  given.  The  office  of  governor  appeared  on  ballot  card  A 
with  other  State-wide  and  Federal  offices.  The  State  question 
appeared  on  ballot  card  B,  and  the  office  of  State  representative 
appeared  on  ballot  card  C. 


Table  2 


Votes  for        Votes  for        Votes  for 
Precinct  Governor  St.  Rep.  Question  #589 


1 

1025 

1039 

982 

6 

509 

515 

484 

10 

379 

398 

359 

34 

881 

941 

914 

39 

989 

1032 

1038 

59 

362 

367 

343 

61 

37 

38 

37 

72 

64 

69 

69 

82 

696 

not  reported 

665 

98 

376 

389 

351 

106 

540 

581 

474 

117 

21 

23 

25 

122 

855 

962 

918 

126 

248 

255 

228 

131 

10 

11 

10 

135 

156 

323 

258 

136 

103 

106 

104 

154 

162 

180 

168 

159 

652 

878 

808 

161 

885 

927 

899 

202 

16 

17 

16 

208 

115 

117 

117 

222 

529 

557 

536 

256 

246 

260 

243 

268 

664 

683 

631 

270 

926 

1218 

1091 
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In  every  case  in  which  a  vote  was  reported  in  the  identified  pre- 
cincts, the  office  of  State  representative  received  more  votes 
than  the  office  of  governor.  In  some  cases.  State  question  #589, 
an  unimportant  issue  that  would  have  been  expected  to  receive 
little  public  interest,  received  more  votes  than  the  office  of 
governor.  Most  independent  election  observers  would  have  diffi- 
culty accepting  this  situation  unless  a  very  special  condition 
of  strong  public  concern  could  be  demonstrated. 

A  commentary  on  this  situation  with  regard  to  precinct  #270,  the 
last  precinct  listed  in  Table  2 .  was  reported  by  The  Sunday  Ok- 
lahoman  on  January  25,  1987  in  an  article  entitled  "Uncertain 
Vote  Count  Puzzling  to  Analysts."  [71]  The  article  pointed  out 
that  in  demographically  comparable  Precinct  #459  in  Tulsa  County, 
the  unusual  reversal  of  drop-off  did  not  occur.  The  race  for 
governor  in  the  comparable  Tulsa  County  precinct  received  more 
votes  than  other  races,  as  would  be  expected. 

4.10  Palm  Beach  County,   Florida;   November,  1984 

Following  the  November,  1984,  general  election,  David  Anderson, 
defeated  candidate  for  Property  Appraiser  of  Palm  Beach  County, 
sued  to  contest  the  election  of  his  opponent  Rebecca  Walker.  [72] 
Anderson  asked  that  the  Court  order  a  hand  recount  of  the  bal- 
lots, or  a  hand  recount  of  at  least  several  precincts  in  that 
election.  The  issues  on  which  Anderson  sued  included  handling  of 
the  ballots,  precinct  procedures  for  signing  in  voters,  ballot 
secrecy,  counting  of  punch  card  ballots,  and  possible  manipula- 
tion of  the  computer  program.  Anderson's  initial  complaint  was 
dismissed  in  Palm  Beach  County  Circuit  Court  on  March  1,  1985 
[73],  but  he  filed  an  amended  complaint.  With  regard  to  the  com- 
puter-related points  at  issue,  Anderson  charged  in  his  amended 
suit  that: 

"There  were  irregular  counts  from  the  computer  on  each 
total,  each  time  it  was  run.  The  tabs  caused  by  perfo- 
rations punched  in  the  voting  process  in  the  computer 
cards  did  not  all  tear  loose,  thereby  seriously  affect- 
ing the  vote  results.  It  is  apparent  that  because  of 
the  type  of  equipment  and  method  used,  that  it  is  im- 
possible to  accurately  count  any  election."  [74] 

Clearly,  there  were  problems  of  hanging  chad  ("tabs. . [that]  did 
not  all  tear  loose")  in  this  election.  In  a  document  filed  in 
connection  with  this  suit  (Defendent  Walker's  First  Request  for 
Admission  to  Plaintiff)  [75],  the  results  of  a  computer  recount 
of  another  contest  in  the  same  election  were  given.  In  the  other 
contest,  Owens  versus  Perry,  Owens'  original  total  of  137,994  in- 
creased by  279  votes  in  the  recount,  while  Perry's  original  total 
of  137,817  increased  by  214  votes.  According  to  Ms.  Jackie  Win- 
chester, Supervisor  of  Elections  in  Palm  Beach  County,  these 
changes  were  due  to  chad  that  were  not  fully  removed  in  the  first 
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count  (thereby  resulting  in  no  vote)  but  which  fell  out  before 
the  recount  (thereby  adding  to  the  original  totals) .  However,  no 
report  of  undervotes  or  overvotes  is  required  by  the  State  of 
Florida  or  by  Palm  Beach  County,  and  therefore  it  is  not  possible 
to  confidently  deduce  from  the  data  that  this  reasonable  supposi- 
tion is  correct. 

In  his  amended  complaint,  Anderson  also  charged  that: 

"The  election  was  run  on  machines  that  permit  a  means 
of  changing  the  result  on  the  ballots  contrary  to  the 
votes  cast  by  electors  through  an  alter  system  in  the 
commands  in  the  computer  program,  or  through  the  use  of 
a  single  or  several  ballot  cards  specially  marked  with 
an  alter  code  on  them,  which  the  Plaintiff  has  reason 
to  believe  was  activated  during  the  counting  of  the 
ballots."  [76] 

No  documentary  evidence  in  support  of  this  claim  was  filed  by  An- 
derson, and  in  fact,  in  his  initial  suit  that  was  dismissed,  An- 
derson had  alleged  that  the  election  "may  have  been"  run  on  ma- 
chines that  should  not  qualify  under  state  laws  since  "there  may 
be"  under  the  system  a  means  of  changing  the  result  through  an 
alter  system  in  the  commands  in  the  computer  program. 

In  a  motion  to  dismiss,  defendent  Rebecca  Walker  noted  that  the 
Department  of  State  of  the  State  of  Florida  previously  approved 
the  voting  system  in  use,  and  that  there  is  no  provision  in  the 
Florida  election  laws  allowing  for  a  hand  recount  of  ballots  cast 
through  the  use  of  an  electronic  voting  system.  [77]  The  Owens- 
Perry  contest  had  been  recounted  by  computer  two  days  after  the 
initial  count  because  it  was  sufficiently  close  to  meet  the  stat- 
utory recount  test.  The  Anderson-Walker  contest  was  insuffi- 
ciently close  to  require  a  recount,  but  was  actually  recounted  as 
a  by-product  of  the  Owens-Perry  recount.  The  computer  recount  of 
the  Anderson-Walker  contest  was  unofficial,  and  the  same  result 
showing  Walker  winning  certainly  did  not  satisfy  Anderson. 

On  March  28,  1985,  according  to  Ms.  Winchester,  a  hand  count  of 
ten  precincts  selected  by  Mr.  Anderson  was  undertaken  by  the 
staff  of  the  Supervisor  of  Elections.  Mr.  Anderson  and  his  ob- 
servers were  in  attendance.  "Mr.  Anderson  and  everyone  else 
present  agreed  that  were  were  no  substantive  differences",  re- 
ported Ms.  Winchester.  On  September  10,  1985,  Mr.  Anderson's 
amended  suit  was  "dismissed  with  prejudice"  by  Circuit  Court 
Judge  Richard  I.  Wennet.  [78] 

4 . 11  Salt  Lake  Countv.  Utah;  November.   198  0 

A  last  minute  breakdown  of  one  of  Salt  Lake  County's  two  ballot 
reading  computers  caused  a  delay  in  production  of  the  tally.  No 
county  totals  were  produced   for  two  hours,    and  the   final  tally 
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was  produced  at  5:39  a.m.  the  following  morning.  The  situation 
was  reported  in  an  article  in  the  Salt  Lake  Tribune  on  Nov.  6, 
1980.  [79] 

Although  spare  parts  were  available,  a  decision  was  made  during 
the  count  not  to  attempt  to  repair  the  machine,  but  to  keep  going 
with  the  one  ballot  computer  that  was  working. 

The  situation  might  have  been  helped  if  a  head  start  on  ballot 
counting  had  been  implemented,  as  was  done  with  paper  ballots. 
However,  it  was  believed  that  this  might  have  created  confusion 
in  the  meshing  of  early-collected  ballots  with  the  later  ones  for 
the  same  precincts.  In  addition,  no  election  workers  were  avail- 
able to  collect  the  early  ballots.  It  would  have  cost  extra 
money  to  hire  additional  workers,  as  others  were  occupied  with 
regular  jobs  during  the  day. 

It  was  noted  that  the  complete  100%  tally  was  available  much  ear- 
lier than  such  a  tally  would  have  been  available  if  paper  ballots 
had  been  used. 

4 . 12  Stark  County.  Ohio;  May.  1986 

The  following  description  is  adapted  from  the  account  given  in 
the  July  21,  1986  issue  of  Election  Administration  Reports  [80], 
Richard  G.   Smolka,   Editor,  with  permission  of  the  publisher. 

Stark  is  a  county  of  about  400,000  population  whose  county  seat. 
Canton,  is  located  about  60  miles  south-southeast  of  Cleveland. 
An  unprecedented  court-ordered  "audit"  (hand  recount)  of  a  Stark 
County  computer  recount  in  a  county  commissioners  primary  contest 
again  named  as  winner  the  candidate  who  had  apparently  won  in  the 
official  results  of  the  May  6,  1986  primary  but  lost  in  the  com- 
puter recount.  The  "audit"  revealed  a  computer  program  error 
that  permitted  over  100  invalid  punchcard  ballots  to  be  counted 
in  the  recount. 

At  the  end  of  the  election-night  count,  Robert  A.  Capestrain  held 
a  2  6-vote  lead  in  the  three-person  contest  to  be  Democratic  nomi- 
nee for  county  commissioner.  A  recount  by  computer  on  May  27. 
(held  because  of  the  closeness  of  the  original  tally)  put  Patty 
Miller  ahead  by  5  votes.  For  the  computer  recount,  the  computer 
program  used  to  obtain  the  original  results  was  not  used.  In- 
stead, a  special  computer  program  was  written,  in  order  to  count 
only  the  disputed  contest  and  not  the  other  contests  on  the  bal- 
lot. The  mystery,  however,  was  why  165  additional  votes  had  been 
tallied  in  the  recount  although  the  number  of  ballots  read  by  the 
computer  was  the  same. 

The  following  table  provides  the  votes  for  the  three  candidates 
in  the  computer  tally  of  the  primary,  the  computer  recount,  and 
the  hand  counted  "audit": 
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Votes  Counted  for  Stark  County  Commissioner 
Democratic  Primary  Election,  1986 


Primary  Recount  Audit 

Candidates  May  8  May  27  Change  July  8  Change 

Robert  A.   Capestrain       12,967  13,018  +  51  12,980  -  38 

Donald  E.  Casar  7,987  8,019  +  32  7,989  -  30 

Patty  Miller  12 . 941  13 .023  +  82  12 . 952  -  71 

TOTALS  33,895  34,060  +165  33,921  -139 


The  165  additional  votes  in  the  recount  were  randomly  distributed 
throughout  the  481  precincts.  Most  precincts  had  no  changes,  and 
most  of  those  with  changes  had  a  one-vote  increase.  All  candi- 
dates gained  votes.  The  names  of  the  candidates  were  rotated  by 
precinct  in  the  ballot  booklets  in  positions  98-100-102,  and  the 
extra  votes  were  distributed  among  these  numbers  on  the  ballot 
cards.  Each  of  the  three  positions  received  approximately  the 
same  number  of  additional  votes. 

Initially,  there  seemed  to  be  no  satisfactory  explanation  for  the 
additional  votes.  Hanging  chad  was  suspected  as  a  possible 
cause.  Fraud  was  much  less  likely  because  it  would  have  required 
access  to  ballots  from  all  affected  precincts,  working  knowledge 
of  the  ballot  rotations,  plus  sufficient  time  to  locate  and  punch 
ballots  which  had  not  been  voted  for  county  commissioner. 

Following  the  computer  recount  that  indicated  a  reversal  of  the 
initial  count,  candidate  Capestrain  filed  suit  challenging  the 
recount.  Because  of  the  unusual  nature  of  the  recount  result  and 
rumors  of  fraud,  the  candidates,  attorneys,  election  board,  and 
court  agreed  to  "audit"  procedures  that  would  resolve  any  identi- 
fiable problems  with  "hanging  chad"  as  well  as  ensure  that  the 
vote  count  would  be  complete  and  accurate.  Most  importantly, 
they  all  agreed  that  the  audit  would  constitute  a  final  resolu- 
tion of  the  vote  count  dispute.  Judge  Harold  E.  DeHoff  of  the 
Stark  County  Court  of  Common  Pleas  included  a  provision  in  the 
agreement  that  all  parties  would  waive  any  rights  of  appeal. 

The  audit  included  a  manual  count  and  a  computer  count.  Forty 
two-person  teams  were  assigned  to  manually  count  the  ballots  un- 
der specific  rules.  The  court  order  also  provided  guidelines  on 
removal  of  hanging  chad  and  specified  that  only  the  two  master 
commissioners,  appointed  by  the  court,  could  remove  a  suspected 
chad  or  hanging  chad. 

Before  the  start  of  the  audit,  Ohio  Director  of  Elections  Dorothy 
Woldorf  and  area  manager  Robert  Braun  of  the  vote-counting  system 
vendor  gave  the  counting  teams  both  written  and  verbal  instruc- 
tions on  procedures  to  be  followed.  The  manual  recount  began  at 
9:00  a.m.  and  continued  until  completion  at  about  7:45  p.m. 
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After  the  first  several  precincts  were  manually  counted,  it  be- 
came evident  that  the  audit  was  producing  totals  more  closely 
matching  the  original  count  rather  than  the  recount.  By  11:00 
a.m.,  the  recount  program  error  had  been  uncovered.  The  error 
was  due  to  the  failure  of  the  recount  program  to  distinguish  be- 
tween Democratic,  Republican,  and  unaffiliated  ballots. 

In  the  May  8  primary,  voters  were  given  Democratic,  Republican, 
or  unaffiliated  ballots,  depending  on  their  party  registration. 
The  logic  in  the  computer  program  and  associated  header  cards 
that  were  used  to  tally  the  primary  ballots  was  able  to  distin- 
guish among  the  different  types  of  ballots,  even  though  all  the 
ballots  were  tallied  on  the  same  computer  equipment. 

In  the  recount,  all  the  ballots  were  again  tallied  together  on 
the  same  equipment,  but  the  logic  of  the  recount  program  could 
not  distinguish  among  the  different  ballot  types.  It  was  appar- 
ently believed  by  the  author  of  the  recount  program  that  the 
assignment  of  unique  ballot  positions  to  each  contest  and  candi- 
date was  sufficient  to  separate  the  ballots.  However,  some  Re- 
publican and  unaffiliated  voters  had  "voted"  (i.e.,  punched  out 
chad)  in  a  ballot  position  assigned  to  a  candidate  in  the  Demo- 
cratic county  commissioner  contest.  These  ballots  were  not 
counted  in  the  Democratic  primary  tally,  but  they  were  counted  by 
mistake  in  the  computer  recount. 

In  the  audit  on  July  8,  the  ballots  were  first  separated  by  party 
before  being  given  to  the  two-person  teams.  The  separation  was 
easily  accomplished  because  the  ballot  types  were  distinguishable 
by  color.  Consequently,  in  the  manual  recount,  "votes"  by  Repub- 
lican and  unaffiliated  voters  were  not  tallied. 

During  the  audit,  the  master  commissioners  completed  removal  of 
chad  on  28  ballot  cards.  Nine  of  these  were  identified  as  "hang- 
ing chad",  and  the  others  were  termed  "bulging  chad".  One  com- 
missioner said  that  it  was  obvious  that  the  voter  had  detached 
the  chad,  but  that  it  had  been  pressed  back  into  position,  prob- 
ably when  the  cards  were  stacked.  The  removal  of  the  chad  by  the 
commissioners  had  no  effect  on  the  outcome,  but  did  increase  the. 
vote  by  a  net  of  2  6  over  the  original  count. 

4.13  Summary  Of  Problem  Types 

The  problems  in  specific  elections  that  have  been  described  are 
categorized  below  in  order  to  identify  the  most  prevalent  types 
and  elucidate  the  specific  difficulties. 

4.13.1  Insufficient  Pre-election  Testing 

Lack  of  sufficient  pre-election  testing  appears  to  be  a  major 
source  of  operational  difficulty.     Problems  in  the  following  sit- 
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uations  would  have  been  avoided  if  significantly  increased  num- 
bers of  test  ballots,  using  many  different  expected  vote  combina- 
tions, had  been  run  through  the  machines  and  the  results  compared 
with  expected  answers: 

*  Carroll  County,  MD;  Nov.,  1984:  A  larger  number  of  test 
ballots,  using  different  combinations  of  voting  possibilities, 
would  have  demonstrated  the  incorrect  vote-counting  due  to  the 
presence  of  the  wrong  utility  program,  and  would  have  avoided  the 
embarrassment  and  controversy  that  resulted. 

*  Elkhart  County,  IN;  Nov.,  1982:  A  larger  number  of  test 
ballots  should  have  brought  to  light  the  three  separate  coding 
errors:  failure  to  distinguish  Wakarusa  voters  from  other  voters 
in  the  same  township,  the  reversed  tallying  in  the  County  Council 
races,  and  the  incorrect  punch  position  used  to  tally  votes  in 
the  State  Representative  contest.  The  fact  that  all  three  errors 
were  identified  after  a  significant  number  of  votes  had  been  ac- 
tually tallied  (and  because  the  strange  results  raised  suspi- 
cions) supports  the  concept  that  more  test  ballots  would  have 
brought  the  errors  to  light  before  the  tallying  began. 

*  Elkhart  County,  IN;  Nov.,  1986:  A  larger  number  of  test 
ballots,  testing  the  correctness  of  the  logical  rules,  would  have 
identified  the  incorrect  logic  of  the  straight  party  overvote  im- 
plementation . 

*  Illinois  Statewide  Testing  Program:  The  use  of  a  larger 
number  of  test  ballots  would  have  made  clear  the  logical  errors 
in  programming  and  coding  that  were  identified.  This  need  was 
recognized  by  the  testers  from  the  State  Board.  [64] 

*  Moline,  II;  April,  1985:  The  implementation  of  pre-elec- 
tion testing  might  have  brought  to  light  the  ballot-reader  fail- 
ure before  the  election,  and  therefore  might  have  prevented  the 
losing  candidate  from  being  certified  as  the  winner. 

*  Stark  County,  OH;  May,  1986:  A  more  complete  checkout 
using  a  large  number  of  ballots  would  have  identified  the  logical 
error  that  caused  the  program  used  in  the  recount  to  fail  to  dis- 
tinguish between  voters  of  different  political  parties. 

*  A  situation  nol:  appearing  in  this  category  is  Maricopa 
County,  AZ.  Adequate  checkout  procedures  in  that  jurisdiction 
prevented  the  incorrect  punch  position  assignment  from  being 
implemented  in  the  election. 

4.13.2  Failure  to  Implement  An  Adequate  Audit  Trail 

*  Dallas,  TX;  April,  1985:  The  failure  to  separately  re- 
port numbers  of  ballots  cast  in  each  part  of  a  split  precinct 
produced  ambiguous  and  suspect  results. 
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*  Elkhart  County,  IN;  Nov.,  1982:  Changes  in  control  cards, 
to  compensate  for  errors  that  were  discovered,  were  not  document- 
ed; retest  of  the  system,   following  the  changes,  was  not  done. 

*  Oklahoma  County,  OK;  Nov.,  1986:  There  were,  in  many 
precincts,  significant  differences  between  number  of  ballots 
tallied  and  number  of  voters  reported  as  voting.  In  some  cases 
the  number  of  ballots  tallied  exceeded  the  number  of  reported 
voters.     These  differences  made  the  results  appear  suspect. 

4.13.3  Failure  to  Provide  for  a  Partial  Manual  Recount 

*  Charleston,  WV;  Nov.,  1980:  The  charges  of  conspiracy, 
and  the  expensive  and  time-consuming  lawsuits,  might  have  been 
avoided  if  the  local  laws  had  required,  or  allowed  for,  a  partial 
manual  recount  without  a  court  order.  When  the  ballots  were  de- 
stroyed, the  essential  evidence  to  disprove  an  incorrect  tally, 
of  whatever  cause,  was  made  permanently  unavailable. 

*  Dallas,  TX;  April,  1985:  Although  a  recount  was  under- 
taken, it  was  a  machine  recount,  using  machines  managed  by  the 
same  organization.  No  manual  recount,  or  recount  managed  by  an 
independent  organization,  was  done.  Consequently,  some  suspicion 
remains. 

*  Moline,  IL;  April,  1985:  A  partial  manual  recount  would 
have  brought  to  light  the  incorrect  results  due  to  the  ballot- 
reader  failure,  and  would  have  prevented  the  losing  candidate 
from  being  certified  as  the  winner. 

*  Oklahoma  County,  OK;  Nov.,  1986:  The  unusual  results  in 
which  lower-level  contests  received  more  votes  than  the  contests 
on  the  top  of  the  ballot  could  not  be  validated.  Thus,  a  serious 
loss  of  public  confidence  could  not  be  prevented. 

*  Palm  Beach  County,  FL;  Nov.,  1984:  The  inability,  under 
Florida  law,  for  the  defeated  candidate  to  force  a  recount  (be- 
cause his  race  was  insufficiently  close) ,  raised  suspicions  un- 
necessarily. A  partial  hand  recount,  as  is  done  in  California, 
might  have  prevented  this  situation  from  arising. 

*  A  situation  not  appearing  in  this  category,  because  an 
unofficial  manual  recount  was  taken  in  order  to  verify  the  dif- 
ferent results  obtained  on  an  independently-managed  system,  is 
Carroll  County,  MD,  November,  1984.  The  combined  manual  count 
and  recount  on  an  independently-managed  system  revealed  the  error 
in  the  original  count. 

4.13.4  Inadequate  Ballots  or  Ballot  Reader  Operation 

*  Carroll   County,   MD;   November,    1984:     A  recount,    in  which 
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read  "checks"  were  ignored,  showed  slightly  different  tallies 
than  the  certified  results.  Chad  is  also  believed  to  be  respon- 
sible for  some  of  the  difference. 

*  Dallas,  TX;  April,  1985:  The  recount  taken  a  few  days  af- 
ter the  election  showed  changes  in  ballots  cast  in  109  of  the  250 
precincts,  and  changes  in  votes  cast  for  at  least  one  of  the  can- 
didates in  161  of  those  precincts. 

*  Gwinnett  County,  GA;  Nov.,  1986:  The  differences  between 
results  obtained  on  different  computers  reading  the  same  ballots 
indicates  the  limitations  of  pre-scored  punch  cards  in  their 
ability  to  provide  reproducible  results. 

*  Moline,  IL;  April,  1985:  Apparently,  a  slipping  timing 
belt  caused  the  reader  to  read  incorrectly.  The  failure  to  pro- 
vide for  a  partial  manual  recount  (see  above)  or  for  sufficient 
pre-election  testing  (see  above)  prevented  identification  of  the 
problem  in  a  timely  manner. 

*  Oklahoma  County,  OK;  Nov.,  1986:  The  ballot  readers  could 
not  read  up  to  11%  of  ballots  cast  in  some  precincts. 

*  Palm  Beach  County,  FL;  Nov.,  1984:  The  changes  in  votes 
cast  on  successive  tallies  of  the  same  punch  card  ballots,  prob- 
ably due  to  the  presence  of  chad,  reduced  the  confidence  of  the 
losing  candidate  in  the  validity  of  the  reported  outcome. 

*  Stark  County,  OH;  May,  1986:  The  final  (third)  count  of 
ballots  verified  the  first  count,  excepting  that  the  results  were 
slightly  different  due  to  chad  fallout  or  deliberate  removal  of 
hanging  chad  by  the  inspection  boards. 

4.13.5  Inadequate  Security  and  Management  Control 

*  Elkhart,  IN,  Nov.,  1982:  Vote-tallying  was  done  in  a  bor- 
rowed facility  with  equipment  and  employees  not  under  management 
control.  Multiprogrammed  computer  operations  independent  of 
vote-tallying  and  not  under  management  control  were  being  carried 
out  while  vote-tallying  proceeded.  A  vendor  representative  was 
permitted  to  operate  the  vote-tallying  process,  and  to  change 
control  cards  without  adequate  documentation,  and  without  regard 
to  requirements  for  re-testing. 

4.13.6  Inadequate  Contingency  Planning 

*  Oklahoma  County,  OK;  Nov.,  1986:  No  administrative  rules 
were  available  to  allow  the  counting  of  the  significant  number 
of  ballots  that  could  not  be  counted  by  machine.  Many  voters 
were  disenfranchised. 

*  Salt  Lake  County,   UT;  Nov.,   1980:  No  backup  was  available 
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when  one  of  two  computers  failed  during  ballot  counting.  The  re- 
sult was  a  count  much  slower  than  expected. 

4.13.7  Inadequate  System  Acceptance  Procedures 

*  Oklahoma  County,  OK;  Nov.,  1986:  The  system  procured  was 
not  adequately  tested  prior  to  acceptance.  There  was  inadequate 
preparation  to  deal  with  the  failures  that  later  occurred 
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5.   APPLYING  INTERNAL  CONTROL  TO  COMPUTERIZED  ELECTIONS 


Many  offices  of  election  administration  have  not  dealt  with  ques- 
tions of  accuracy,  integrity,  and  security  in  a  systematic  man- 
ner. It  appears  that  in  many  situations,  responses  to  problems 
and  concerns  of  this  type  have  been  on  a  case-by-case  basis.  Re- 
sponses are  even  more  fractionated  when  questions  of  accuracy, 
integrity,  and  security  are  treated  separately. 

The  discipline  of  internal  control,  covering  all  of  these  factors 
from  a  mangagement  point  of  view,  has  not  been  systematically  ap- 
plied to  the  operational  aspects  of  election  administration. 
This  is  not  surprising,  since  election  services  are  not  priced 
for  sale  to  its  users,  as  are  privately  supplied  services.  In- 
ternal control  has  not  been  systematically  applied  in  operational 
situations  where  transactions  between  an  organization  and  its 
clients  cannot  be  measured  in  money. 

A  proposed  minimal  extension  in  concept,  described  below  in  sec- 
tion 5.4.4,  makes  internal  control  applicable  to  election  ser- 
vices. With  this  change,  the  systematic  techniques  of  internal 
control  may  be  used.  Persons  knowledgeable  in  the  discipline  may 
be  employed  or  consulted  to  ensure  the  competent  and  coordinated 
application  of  appropriate  techniques.  The  result  should  be  the 
achievement  of  increased  confidence  in  election  outcomes. 

5 . 1  Internal  Control  And  Computer  Security 

In  the  past,  internal  control  has  been  treated  as  a  subject  sepa- 
rate from  computer  security.  An  example  of  the  earlier  treatment 
is  in  Federal  Information  Processing  Standards  Publication  (FIPS 
PUB)  31,  Guidelines  for  Automatic  Data  Processincf  Physical  Secur- 
ity and  Risk  Management  [81].  This  1974  publication  (which  re- 
mains pertinent  at  this  time)  has  a  separate  section  on  internal 
control  that  is  distinct  from  sections  covering  contingency  plan- 
ning and  physical  security.  This  treatment  of  internal  control 
was  adopted  in  the  1975  vote-tallying  report,  and  in  that  report, 
also,  a  separate  section  on  internal  control  was  inserted  to  cov- 
er separation  of  duties  and  management  of  the  program  development 
process  [82].  The  distinction  made  in  these  reports  is  not  sur- 
prising, in  view  of  the  disparate  origins  of  the  concepts  of  in- 
ternal control  and  computer  security.  Internal  control  origi- 
nated in  accounting,  while  the  source  of  computer  security  is 
computer  science,  itself  an  outgrowth  of  electrical  engineering 
and  mathematics. 

A  more  recent  treatment  considers  the  two  subjects  in  a  more  con- 
nected manner.  A  publication  with  a  different  understanding  of 
the  interconnected  nature  of  the  two  subjects  is  entitled  Work 
Prioritv  Scheme  for  EDP  Audit  and  Computer  Security  Review.  As 
stated  in  this  1986  report: 
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Security  must  be  recognized  as  only  one,  albeit  a  major 
category  of  internal  controls.  ...computer  security 
controls  are  a  subset  of  the  internal  controls  found  in 
an  automated  information  system.  The  major  difference 
between  these  two  sets  of  controls  is  that  internal 
controls  address  efficiency  and  effectiveness  in  addi- 
tion to  security  issues.  [83] 

Thus,  in  this  study  (and  in  much  professional  auditing  litera- 
ture) ,  internal  control  is  interpreted  to  encompass  all  controls, 
including  computer  security  controls,  used  to  ensure  confidence 
in  organizational  systems.  However,  a  need  for  distinctions  be- 
tween kinds  of  controls  remains  —  to  facilitate  their  under- 
standing and  because  various  types  of  controls  require  special- 
ized knowledge  to  assure  their  effective  implementation. 

5 . 2  Internal  Control  As  Control  Of  Assets 

Internal  control  is  a  management  tool  used  within  an  organiza- 
tion. In  the  Federal  Government,  each  department  and  agency  is 
required  to  establish  and  maintain  an  adequate  system  of  internal 
control  under  the  Budgeting  and  Accounting  Procedures  Act  (also 
called  the  Accounting  and  Auditing  Act)  of  1950.  Requirements 
for  applying  internal  control  have  been  updated  since  1950,  with 
the  Federal  Managers'  Financial  Integrity  Act  of  1982. 

One  view  of  internal  control  is  that  it  is  for  the  purpose  of 
controlling  financial  transactions  and  the  use  of  tangible  assets 
(primarily  funds  and  property)  in  an  organization.  This  concept 
of  internal  control  is  typified  by  the  following  definition, 
taken  from  the  Federal  Managers'  Financial  Integrity  Act,  and 
quoted  in  Circular  No.  A-123  (Revised)  of  the  U.S.  Office  of  Man- 
agement and  Budget  (0MB) : 

The  plan  of  organization  and  methods  and  procedures 
adopted  by  management  to  provide  reasonable  assurance 
that: 

*  obligations  and  costs  are  in  compliance  with  applica- 
ble law; 

*  funds,  property,  and  other  assets  are  safeguarded 
against  waste,  loss,  unauthorized  use,  or  misappropria- 
tion; and 

*  revenues  and  expenditures  applicable  to  agency  opera- 
tions are  properly  recorded  and  accounted  for  to  permit 
the  preparation  of  accounts  and  reliable  financial  and 
statistical  reports  and  to  maintain  accountability  over 
the  assets.  [84] 

For  an  office  of  election  administration,   internal  control  as  de- 
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fined  above  may  be  immediately  applied  to  assure  that  computers 
owned  by  the  organization  are  not  stolen  or  misappropriated  or, 
for  example,  to  assure  that  the  goods  procured  under  purchase  or- 
ders have  actually  been  delivered.  However,  internal  control  as 
defined  above  is  not  applicable  to  non-financial  operations  such 
as  vote-tallying,  and  this  omission  has  created  difficulties  that 
need  to  be  rectified.  The  public  must  have  the  same  confidence 
in  reported  election  results  that  it  has  in  the  reported  status 
of  its  individual  bank  accounts. 

5 . 3  Voting  And  Banking  Operations:  Accounting  Similarities 

The  similarity  of  accounting  problems  in  voting  and  in  banking 
have  been  noted  elsewhere.  In  the  1975  vote-tallying  report,  it 
was  stated  that: 

The  problem  of  assuring  correctness  and  security  of 
vote-tallying  programs  is  not  significantly  different 
than  assuring  correctness  and  security  of  computer 
programs  used  for  sensitive  financial  and  record-keep- 
ing purposes.  Technical  safeguards  and  management 
techniques  developed  for  other  applications  can  be 
adopted  for  vote-tallying  programs.  [85] 

However,  the  similarity  in  control  techniques  is  more  widespread 
than  just  in  computer  programs.  As  noted  by  Ms.  Suzan  N.  Kesim 
in  the  Texas  legislative  hearings   (section  2.8.3): 

"Whether  you  are  adding  dollars  or  votes,  you  can  apply 
many  of  the  same  auditing  standards....  Many  of  the 
computer  auditing  procedures  used  by  the  banking  indus- 
try that  have  been  tried  and  true  could  easily  be  modi- 
fied or  used  as  they  are  for  auditing  elections....  " 

In  U.S.  banking  operations,  the  currency  unit  is  the  "dollar," 
while  in  another  nation,  the  currency  unit  may  be  the  "pound," 
"mark,"  "franc,"  "yen,"  or  something  else.  The  concepts  of  in- 
ternal control  will  not  change  with  a  different  hard  currency 
unit,  and  they  should  not  change  if  the  currency  unit  is  the 
"vote. " 

The  voting  process  is  very  similar  to  a  special  kind  of  savings 
bank  operation.  Each  candidate  or  issue  alternative  may  be 
thought  of  as  having  an  individual  savings  account,  with  the  ac- 
counts grouped  into  contests.  Each  registered  voter  entering  the 
polling  place  (or  having  an  absentee  ballot)  may  be  thought  of  as 
a  qualified  depositor,  having  the  right  to  make  deposits  to  the 
contests  for  which  the  voter  is  entitled  to  vote.  In  a  vote-for- 
one  situation,  the  voter  may  deposit  only  one  vote  in  one  account 
per  contest;  in  a  vote-f or-more-than-one  situation,  the  voter  may 
make  deposits  in  more  than  one  account  per  contest,  but  in  almost 
all  cases,  may  not  deposit  more  than  one  vote  per  account. 
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If  votes  were  treated  as  tangible  assets  and  inherently  valuable, 
like  coins  of  denomination  "one  vote,"  they  would  be  normally 
treated  as  subjects  of  internal  control  procedures.  Then,  ac- 
counting for  the  votes  that  the  voters  deposited  could  be  carried 
out,  and  would  be  carried  out  as  a  matter  of  ordinary  accounting 
practice.  Each  voter  would  have  received  the  coins  to  be  depos- 
ited at  the  assigned  polling  place,  as  part  of  the  sign-in  pro- 
cess. Each  voter  would  have  been  previously  approved  as  a  depos- 
itor by  virtue  of  having  met  certain  qualifications  such  as  those 
relating  to  age,  citizenship,  and  residency. 

Following  the  completion  of  the  voting  process,  an  internal  audi- 
tor (a  person  who  reviews  the  implementation  and  adequacy  of  in- 
ternal controls)  would  be  concerned  with  the  assurance  that  none 
of  the  coins  used  were  counterfeit,  that  persons  receiving  the 
coins  to  be  cast  as  votes  were  truly  qualified  to  receive  them, 
and  that  the  recorded  account  balances  were  correct  according  to 
the  rules  of  the  depositing  process.  To  assure  that  account  bal- 
ances were  correct,  as  well  as  to  assure  the  return  of  the  tan- 
gible assets,  it  would  be  necessary  to  account  for  the  use  and 
disposition  of  all  coins,  including  those  not  voted  for  any  can- 
didate (undervotes) ,  and  those  not  voted  according  to  the  rules 
concerning  number  of  votes  per  contest  (overvotes) . 

Thus,  one  method  of  ensuring  the  applicability  of  internal  con- 
trol to  vote-tallying  is  to  treat  votes  as  tangible  assets.  With 
this  conception,  controls  may  be  applied  to  assure  that  only 
qualified  voters  are  entitled  to  vote,  and  to  assure  that  a  full 
accounting  is  made  of  the  disposition  of  all  the  votes  distri- 
buted for  use.  With  the  use  of  internal  control  techniques  in 
this  manner,  vote-tallying  would  be  able  to  achieve  the  confi- 
dence of  the  public. 

It  may  be  noted  that,  in  at  least  one  way,  voting  is  a  more  dif- 
ficult process  to  audit  than  banking.  In  voting,  the  depositor 
(voter)  is  not  given  a  record  of  his  or  her  own  account.  Thus, 
the  help  that  the  depositors  normally  provide  to  the  auditors  in 
the  verification  of  account  statements  cannot  be  present.  Other 
verification  techniques,  such  as  manual  recounting,  must  be  used 
in  vote-tallying  to  substitute  for  the  inability  of  the  voter  to 
be  of  assistance  for  this  purpose. 

A  more  generic  way  of  making  internal  control  applicable  to  elec- 
tion administration,  without  the  need  to  consider  votes  as  tangi- 
ble assets,  is  given  immediately  below.  This  change  in  concept 
would  permit  both  voter  registration  and  the  voting  process  to  be 
considered  as  subjects  of  internal  control. 

5 . 4  The  GAP  Concept  Of  Internal  Control 

With  the  passage  of  the  Federal  Managers'  Financial  Integrity  Act 
of   1982,    the  U.S.    General   Accounting  Office    (GAO)    was  required. 


90 


under  the  act,  to  develop  and  publish  standards  for  the  applica- 
tion of  internal  control  in  the  Federal  Government  [86].  There 
is  nothing  in  these  standards  that  would  restrict  them  to  the 
Federal  level,  and  with  a  broader  definition  of  the  term  "trans- 
action," they  are  applicable  to  any  governmental  function  such  as 
election  administration.  The  GAO  concept  of  internal  control  is 
used  here,  rather  than  other  models,  because  it  appears  most  ap- 
propriate for  governmental  operations. 

In  its  publication,  the  GAO  provided  four  purposes  of  internal 
control  and  a  somewhat  different  definition  of  internal  control 
than  that  given  above.  The  GAO  noted  also  that  ultimate  respon- 
sibility for  good  internal  controls  rests  with  management. 

5.4.1  Purposes  of  Internal  Control 

The  purposes  of  internal  control  identified  by  the  GAO  are  as 
follows : 

*  To  help  regulate  and  guide  operations;  Internal  con- 
trols are  not  specialized  systems  within  an  agency. 
They  should  be  recognized  as  an  integral  part  of  each 
system  that  management  uses  to  regulate  and  guide  its 
operations . 

*  To  achieve  proper  conduct  with  accountability;  Inter- 
nal controls  are  essential  for  achieving  the  proper 
conduct  of  Government  business  with  full  accountability 
for  the  resources  made  available. 

*  To  prevent  undesired  actions;  Internal  controls  fac- 
ilitate the  achievement  of  management  objectives  by 
serving  as  checks  and  balances  against  undesired  ac- 
tions . 

*  To    achieve    positive    aims;     Internal    controls  help 
achieve  the  positive  aims  of  program  managers. 

It  can  be  understood,  from  these  purposes,  that  it  is  possible  to 
view  internal  control  from  a  broader  perspective  than  just  con- 
trol of  obligations  and  costs,  and  the  safeguarding  of  assets. 
The  purpose  of  achievement  of  positive  aims  provides  an  addition- 
al viewpoint  for  internal  control;  the  effective  execution  of 
programs . 

5.4.2  GAO  Definition  of  Internal  Control 

The  definition  of  internal  control  provided  by  the  GAO  is  as  fol- 
lows: 

The    plan    of    organization    and    methods    and  procedures 
adopted  by  management  to  ensure  that; 
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*  resource   use    is   consistent   with   laws,  regulations, 
and  policies; 

*  resources   are   safeguarded   against   waste,    loss,  and 
misuse;  and  that 

*  reliable   data   are   obtained,    maintained,    and  fairly 
disclosed  in  reports. 

The  significant  difference  between  this  definition  and  the  0MB 
definition  provided  in  section  5.2  above  is  that  the  GAO  defini- 
tion is  concerned  with  "resource  use"  whereas  the  0MB  definition 
is  concerned  with  "obligations  and  costs."  Resources  include 
personnel,  and  while  some  personnel  may  be  part  of  a  production 
process  that  converts  tangible  raw  materials  into  tangible  pro- 
duct, an  important  function  of  personnel  in  government  is  deci- 
sionmaking. Internal  control  must  be  concerned  with  decisionmak- 
ing, if  it  is  concerned  with  the  "proper  conduct"  of  government 
business,  the  prevention  of  "undesired  actions"  and  the  achieve- 
ment of  "positive  aims." 

In  election  administration,  some  important  decisions  concern  de- 
sign and  use  of  a  voter  registration  system;  procurement,  accept- 
ance, and  deployment  of  vote-tallying  equipment;  scheduling  of 
events  to  assure  election  readiness;  ballot  design;  computer  se- 
curity; audit  trails;  the  system  for  results  dissemination  and 
documentation;  and  the  certification  of  winners. 

Government  operations  often  convert  data  into  decisions,  a  pro- 
cess qualitatively  different  than  manufacturing.  In  such  a  gov- 
ernment operation,  the  real  inputs  and  outputs  have  little  eco- 
nomic relationship  to  the  tangible  materials  (data  storage  media 
and  computers)  used.  The  data  anu  decisions  often  have  signifi- 
cant economic  value  and  economic  consequences,  but  these  cannot 
be  measured  by  the  costs  of  the  media  and  computers  on  which  the 
data  and  decisions  are  recorded  and  processed.  Thus,  internal 
control,  if  it  is  to  be  maximally  useful,  cannot  be  based  solely 
on  safeguarding  the  tools  of  production.  It  must  be  concerned 
with  the  operational  activity  and  the  formation  of  the  decisions 
that  are  the  real  products  of  the  organization. 

5.4.3  GAO  General  Standards 

The  internal  control  standards  that  the  GAO  specified  are  divided 
into  two  classes:  general  standards,  and  specific  standards.  The 
standards  are  intended  to  apply  to  all  operations  and  administra- 
tive functions  in  an  agency.  In  addition,  the  GAO  specified  that 
there  should  be  prompt  resolution  of  any  finding  or  recommenda- 
tion made  by  internal  auditors  that  concerns  an  identified  defi- 
ciency in  internal  control. 
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The  general  standards  provide  the  foundation  without  which  imple- 
mentation of  internal  control  would  not  be  possible.  The  five 
general  standards  (identified  below  with  the  letter  "G")  can  ap- 
ply to  any  government  agency,   and  are  as  follows: 

Gl.  Reasonable  Assurance;  Internal  control  systems  are 
to  provide  reasonable  assurance  that  the  objectives  of 
the  systems  will  be  accomplished. 

This  standard  implies  that  the  cost  of  internal  control  should 
not  exceed  the  benefit  derived.  Thus,  to  determine  a  reasonable 
expenditure  on  internal  control,  an  agency  must  identify  the  vul- 
nerabilities inherent  in  operations,  establish  the  level  of  risk 
(high,  medium,  or  low)  for  each  vulnerability,  and  determine  the 
acceptable  level  of  risk  under  varying  circumstances.  (Vulnera- 
bilities of  different  vote-tallying  systems  were  identified  in 
chapter  3 . ) 

G2 .  Supportive  Attitude;  Managers  and  employees  are  to 
maintain  and  demonstrate  a  positive  and  supportive  at- 
titude toward  internal  controls  at  all  times. 

A  positive  and  supportive  attitude  is  ensured  when  internal  con- 
trols are  a  consistently  high  management  priority.  General 
leadership  is  critical  to  maintaining  a  positive  and  supportive 
attitude  toward  internal  control. 

G3 .  Competent  Personnel :  Managers  and  employees  are  to 
have  personal  and  professional  integrity  and  are  to 
maintain  a  level  of  competence  that  allows  them  to  ac- 
complish their  assigned  duties,  as  well  as  understand 
the  importance  of  developing  and  implementing  good  in- 
ternal controls. 

Managers  who  possess  a  good  understanding  of  internal  controls 
are  vital  to  effective  control  systems.  Individuals  should  be 
given  the  necessary  formal  and  on-the-job  training. 

G4 .  Control  Objectives;  Internal  control  objectives  are 
to  be  identified  or  developed  for  each  agency  activity 
and  are  to  be  logical,  applicable,  and  reasonably  com- 
plete. 

Agency  control  systems  may  be  classified  into  management,  finan- 
cial, programmatic,  and  administrative.  Control  objectives 
should  be  tailored  to  the  specific  responsibilities  of  each 
agency. 

G5.  Control  Techniques;  Internal  control  techniques  are 
to  be  effective  and  efficient  in  accomplishing  their 
internal  control  objectives. 
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Internal  control  techniques  are  the  mechanisms  by  which  control 
objectives  are  achieved.  Techniques  include  policies,  proce- 
dures, plans  of  organization,  and  physical  arrangements.  To  be 
effective,  techniques  should  fulfill  their  intended  purpose  in 
actual  application.  To  be  efficient,  techniques  should  be  de- 
signed to  derive  maximum  benefit  with  minimum  effort.  Efficient 
implementations  make  possible  lower  risks  (see  general  standard 
Gl)  since  a  more  efficient  implementation  implies  a  higher  degree 
of  control  at  the  same  or  lower  cost. 

5.4.4  The  Concept  of  a  Non-Financial  Transaction 

In  order  to  apply  the  GAO  specific  standards  to  the  voting  pro- 
cess, the  traditional  definition  of  "transaction"  needs  to  be 
extended.  According  to  the  Handbook  of  EDP  Auditing  [87],  trans- 
actions are: 

business  events  that  can  be  measured   in  money  and  are 
entered  in  the  accounting  records. 

In  election  administration,  and  in  other  services  that  are  not 
priced  for  sale,  the  product  of  the  organization  is  not  measured 
in  money.  As  pointed  out  above,  it  is  decisions  that  define  the 
process  of  election  administration.  Some  of  the  decisions  that 
personally  concern  the  voter  or  the  candidate  include  the  fol- 
lowing: registration  of  a  voter,  the  removal  of  a  voter's  name 
from  the  registration  file,  the  tender  of  a  ballot  (or  the  offer 
of  the  use  of  a  DRE  machine)  to  a  voter  at  a  polling  location, 
and  the  certification  of  a  contest  result  following  the  counting 
of  the  ballots. 

These  decisions  concern  the  implementation  of  entitlements,  spe- 
cifically, entitlements  to  vote  and  to  certification  as  a  winner. 
The  completion  of  the  entitlement  depends  on  satisfaction  of  cer- 
tain necessary  conditions.  Some  of  the  conditions  may  be  volun- 
tary, e.g.,  signing  in  at  the  polling  place  on  election  day,  and 
others  may  be  mandatory,  e.g.,  receiving  more  votes  than  any  op- 
ponent. Other  non-priced  operations  (not  necessarily  in  election 
administration)  may  be  concerned  with  obligations,  rather  than 
with  entitlements.  Thus,  a  definition  for  a  non-financial  trans- 
action is  proposed  as  follows: 

an  event,  occurring  in  the  course  of  organizational  ac- 
tivity, that  consists  of  a  step  in  the  implementation 
of  an  entitlement  or  an  obligation  and  that  is  entered 
in  the  official  records. 

5.4.5.  GAO  Specific  Standards 

With  this  change  in  the  concept  of  a  transaction,  the  following 
six  GAO  specific  standards  for  internal  control  (identified  by 
the  letter  "S"  to  contrast  with  the  general  standard  given  above) 
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are  presented  here  for  their  application  in  election  administra- 
tion: 


51.  Documentation ;  Internal  control  systems  and  all 
transactions  and  other  significant  events  are  to  be 
clearly  documented,  and  the  documentation  is  to  be 
readily  available  for  examination. 

According  to  the  GAO,  documentation  of  transactions  or  other  sig- 
nificant events  should  be  complete  and  accurate  and  should  facil- 
itate tracing  the  transaction  or  event  and  related  information 
from  before  it  occurs,  while  it  is  in  process,  and  after  it  is 
completed.  Here,  support  may  be  inferred  for  audit  trails  in 
vote-tallying,  and  for  providing  complete  documentary  support  for 
a  decision  to  certify  the  result  of  a  contest. 

52.  Recording  of  Transactions  and  Events:  Transactions 
and  other  significant  events  are  to  be  promptly  record- 
ed and  properly  classified. 

This  standard  extends  the  implementation  requirements  for  stan- 
dard SI  above.  This  standard  applies  to  the  entire  process  or 
life  cycle  of  a  transaction  or  event,  including  its  authoriza- 
tion,  initiation,  processing,  and  final  recording. 

53.  Execution  of  Transactions  and  Events:  Transactions 
and  other  significant  events  are  to  be  authorized  and 
executed  only  by  persons  acting  within  the  scope  of 
their  authority. 

This  standard  provides  support  for  assurance  that  only  approved 
activities  will  be  carried  out.  It  provides  a  basis  for  the  for- 
malization of  relationships  between  an  election  administration 
and  its  vendors,  so  that  the  activities  carried  out  by  a  vendor 
during  any  election-related  operation  are  fully  authorized  and 
controlled. 

54 .  Separation  of  Duties;  Key  duties  and  responsibili- 
ties in  authorizing,  processing,  recording,  and  review- 
ing transactions  should  be  separated  among  individuals. 

To  reduce  risks,  no  one  individual  should  control  all  key  aspects 
of  a  transaction  or  event.  Duties  and  responsibilities  should  be 
assigned  systematically  to  a  number  of  individuals  to  ensure  that 
effective  checks  and  balances  exist.  An  example  of  this  in  elec- 
tion administration  is  the  use  of  members  of  more  than  one  party 
to  serve  jointly  as  election  judges  at  precincts.  Separation  of 
responsibilities  for  computer  program  design  and  for  computer  op- 
eration is  another  example. 

55.  Supervision:  Qualified  and  continuous  supervision 
is  to  be  provided  to  ensure  that  internal  control  ob- 

95 


jectives  are  achieved. 

This  standard  requires  that  supervisors  provide  their  staffs  with 
the  necessary  guidance  and  training  to  help  ensure  that  errors, 
waste,  and  wrongful  acts  are  minimized  and  that  specific  manage- 
ment directives  are  achieved.  To  carry  out  this  standard,  exper- 
tise in  internal  control  must  be  available  in  the  organization. 
This  need  is  considered  further  in  section  5.6. 

S6.  Access  to  and  Accountability  for  Resources:  Access 
to  resources  and  records  is  to  be  limited  to  authorized 
individuals,  and  accountability  for  the  custody  and  use 
of  resources  is  to  be  assigned  and  maintained.  Period- 
ic comparison  shall  be  made  of  the  resources  with  the 
recorded  accountability  to  determine  whether  the  two 
agree.  The  frequency  of  the  comparison  shall  be  a 
function  of  the  vulnerability  of  the  asset. 

This  standard  applies  to  tangible  resources,  for  example,  vote- 
tallying  equipment,  computer  programs,  and  blank  ballots.  Blank 
ballots  that  have  been  printed  for  a  specific  election,  in  antic- 
ipation of  the  election,  are  similar  to  blank  checks  in  their 
vulnerability.  The  GAO  identifies  blank  checks  as  a  type  of  re- 
source which  should  be  protected  by  being  kept  physically  safe, 
having  each  separate  document  assigned  a  sequential  number,  and 
by  assigning  custodial  accountability  to  responsible  individuals. 
By  analogy,  blank  ballots  for  a  forthcoming  election  should  be 
similarly  treated.  For  computer  programs,  the  working  copies 
similarly  should  be  kept  physically  safe,  custodial  accountabil- 
ity should  be  assigned,  and  the  working  copies  should  be  compared 
with  reference  copies  to  assure  complete  agreement. 

5 . 5  A  Classification  Of  Internal  Controls 

A  classification  of  internal  controls  is  provided  here  in  order 
to  more  specifically  describe  the  application  of  the  concept.  In 
addition,  certain  specific  recommendations  of  this  report  will  be 
shown  to  be  consistent  with  internal  control  techniques  of  a  par- 
ticular type. 

Internal  controls  are  divided  into  internal  accounting  controls 
and  administrative  controls.  Internal  accounting  controls,  which 
of  primary  interest,  are  divided  into  general  controls  and  appli- 
cation controls.  General  controls  concern  the  preparation  of 
systems  for  the  carrying  out  of  operations,  and  may  be  called  in- 
tegrity controls.  Application  controls  concern  the  actual  pro- 
cessing of  documents  and  data  in  the  course  of  operations. 

5.5.1  General  Controls 

These  are  the  controls  over  computing  and  vote-tallying  hardware, 
software,   and  facilities,   but  not  the  actual  processing  of  votes 
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votes  or  of  changes  to  the  voter  registration  files.  Hardware, 
software,  and  facilities  concern  both  precinct  locations  and  cen- 
tral locations.  Specific  categories  of  control  include  the  fol- 
lowing, where  the  titles  in  parentheses  refer  to  similar  catego- 
ries identified  and  discussed  in  the  Handbook  of  EDP  Auditing 
[88]  .  Particular  category  definitions  used  here  may  be  somewhat 
different,  so  that  they  apply  more  specifically  to  election  prep- 
arations) : 

Access  Controls  (Data  file  security  controls) :  These  controls 
concern  physical  access  to  the  computing  and  vote-tallying  site 
or  sites,  electronic  access  through  terminals  and  communications 
links,  and  access  to  separate  data  files,  such  as  for  voter  reg- 
istration. The  controls  are  for  the  purpose  of  assuring  that 
only  authorized  accesses  are  made,  and  only  for  authorized  pur- 
poses. 

Development  and  Implementation  Controls  (Implementation  con- 
trols) :  These  controls  are  for  the  purpose  of  assuring  that  the 
hardware  and  software  of  new  systems,  and  authorized  changes  to 
existing  systems,  are  correctly  implemented  and  contain  all  nec- 
essary features  (or  meet  certification/acceptance  criteria  in  the 
case  of  procured  hardware  and  software) .  These  controls  also 
concern  assurance  that  all  necessary  preparations  have  been  made 
for  a  computerized  election,  including  specialization  of  soft- 
ware. 

System  Controls  (System  software  controls) :  These  controls  are 
for  the  purpose  of  assuring  that  no  unauthorized  modifications 
are  made  to  system  hardware  or  software.  System  software  con- 
sists of  operating  systems,  compilers,  and  other  computer  pro- 
grams not  specific  to  any  application.  System  hardware  includes 
vote-tallying  computers  or  devices  of  any  type. 

Application  Software  Controls  (Program  security  controls) :  These 
controls  are  for  the  purpose  of  assuring  that  no  unauthorized 
modifications  are  made  to  application  software  already  in  use. 

Computer  Operations  Controls  (Computer  operations  controls) : 
These  controls  provide  an  audit  trail  for  operation  of  the  com- 
puting and  vote-tallying  devices,  and  concern  the  assurance  of 
adequate  backup  and  recovery  procedures  in  case  of  malfunction. 

5.5.2  Application  Controls 

These  controls  apply  to  the  processing  of  documents  and  data  in 
the  course  of  the  voter  registration  and  vote-tallying  processes. 
As  above,  titles  in  parentheses  refer  to  similar  categories  iden- 
tified and  discussed  in  the  Handbook  of  EDP  Auditing  [89].  As 
above,  particular  category  definitions  may  be  somewhat  different, 
so  that  they  apply  more  specifically  to  election  operations) : 
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Input  Controls  (Controls  for  completeness  and  accuracy  of  input) : 
Completeness  refers  to  the  processing  of  each  input  document  once 
and  only  once,  while  accuracy  refers  to  the  correct  entry  of  the 
data  on  each  document.  In  voting,  completeness  of  input  concerns 
controls  over  the  voter  sign-in  process  at  precincts  (e.g.,  to 
match  number  of  voters  against  ballots  issued) ,  distribution  and 
accounting  for  use  of  all  ballots,  the  collection  and  transporta- 
tion of  voted  ballots  for  processing,  and  the  assurance  that  bal- 
lots are  entered  for  counting  once  and  only  once.  Accuracy  of 
input  in  voting  concerns  the  ability  of  the  vote-tallying  equip- 
ment to  accurately  read  each  ballot  (or  set  of  voter  choices  in  a 
DRE  system) ,  and  to  accurately  send  and  receive  communicated  pre- 
cinct summaries.  In  registration,  input  controls  are  for  the 
purpose  of  assuring  the  correctness  of  the  entry  of  changes  into 
the  system  that  holds  the  list  of  registered  voters. 

Validity  Controls  (Validity  controls) :  These  controls  help  to 
prevent  two  types  of  problems:  invalid  input  documents  and  inval- 
id data  on  the  documents.  Controls  to  prevent  counterfeit  bal- 
lots may  be  considered  to  be  in  this  category.  In  vote-tallying, 
these  controls  could  help  prevent  a  mixup  in  assigning  ballots  to 
an  incorrect  precinct  during  tallying.  In  registration,  these 
controls  could  help  identify  voter  addresses  that  do  not  exist, 
or  are  outside  of  a  specified  range. 

Processing  Controls  (Controls  for  completeness  and  accuracy  of 
update) :  In  vote-tallying,  these  controls  assist  in  the  verifi- 
cation of  the  correctness  of  the  results.  If  proper  ballot  ac- 
counting has  been  done  (see  Input  Controls  above) ,  then  reconcil- 
iation of  votes  cast  with  ballots  cast  can  be  accomplished,  pro- 
vided that  records  are  kept  on  undervotes  and  overvotes.  Re- 
counting may  be  considered  to  be  a  control  in  this  category.  In 
registration,  these  controls  provide  assurance  that  the  intended 
changes  to  the  files  have  been  carried  out  correctly.  In  regis- 
tration, no  arithmetic  checks  on  summary  data  can  be  made,  since 
the  data  is  not  being  counted,  like  votes  or  money.  However,  the 
number  of  registered  voters  at  the  end  of  the  day  must  be  consis- 
tent with  the  number  of  registered  voters  at  the  beginning  of  the 
day,  given  a  particular  number  of  registered  voters  added  and  de- 
leted. 

File  Maintenance  Controls  (Control  techniques  employed  for  main- 
tenance) :  This  type  of  control  helps  assure  currency  of  data  in 
the  registration  file,  and  supporting  geographic,  geocoding,  and 
postal  information  files.     It  does  not  apply  to  vote-tallying. 

5 . 6     The  Discipline  Of  Internal  Control 

5.6,1  Link  to  a  Professional  Body  of  Knowledge 

Internal  control  is  a  professional  body  of  knowledge  that  is 
known,    taught,    and   applied  by   internal   auditors   and   EDP  (elec- 
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tronic  data  processing)  auditors.  Professional  associations  that 
are  concerned  with  the  subject  of  internal  control  include  the 

American  Institute  of  Certified  Public  Accountants,  1211  Avenue 
of  the  Americas,   New  York,   NY  10036,    (phone:   212-575-6700)  ; 

Institute  of  Internal  Auditors,  249  Maitland  Avenue,  Altamonte 
Springs,   FL  32701,    (phone:   407-830-7600) ;  and  the 

EDP  Auditors  Association,  455  Kehoe  Boulevard,  Carol  Stream,  IL 
60188    (phone:    312-682-1200) . 

Since  internal  control  is  part  of  a  professional  body  of  know- 
ledge, the  concepts  and  application  of  internal  control  can  be 
learned  in  an  organized,  consistent,  and  uniform  manner  by  elec- 
tions personnel.  Publications,  both  professional  journals  and 
textbooks,  are  widely  available.  Professional  conferences  are 
held  annually  or  more  often. 

5.6.2  Job  Functions  for  Internal  Control 

The  need  for  implementation  of  internal  control  concepts  could  be 
satisfied  by  the  establishment  of  appropriate  job  functions  in 
the  office  of  election  administration.  Examples  of  appropriate 
job  functions  are  given  in  Guide  to  Auditincf  for  Controls  and 
Security:  A  System  Development  Life  Cycle  Approach  [90],  a  publi- 
cation of  the  National  Bureau  of  Standards.  This  publication 
identifies  separate  "'internal  control  officer"  and  "system  secu- 
rity officer"  positions.  The  publication  envisions  that,  in  a 
large  government  department,  there  would  be  senior  officer  po- 
sitions at  the  department  level,  and  separate  "specialist"  posi- 
tions at  the  operational  level,  but  this  concept  may  not  be  ap- 
plicable to  an  office  of  election  administration  in  a  local  gov- 
ernment. In  local  government,  it  may  be  advisable,  due  to  bud- 
getary and  workload  constraints,  to  fold  in  the  "system  security 
officer"  responsibilities  into  the  "internal  control  officer" 
position.  A  person  in  data  processing,  knowledgeable  in  computer 
security,  could  be  trained  in  the  additional  techniques  of  inter- 
nal control  to  occupy  this  position. 

The  responsibilities  of  the  "internal  control  officer"  might  be 
specified  as  follows: 

The  internal  control  officer  (ICO)  establishes  internal 
control  (including  computer  security)  policies  and  en- 
sures that  operational  systems  comply  with  these  poli- 
cies. The  ICO  assures  that  each  operational  system 
meets  basic  standards  for  documentation,  recording  of 
transactions,  execution  of  transactions,  separation  of 
duties,  access  to  resources,  and  all  other  internal 
control  requirements. 
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In  addition  to  the  ICO,  the  employment  of  an  internal  auditor 
could  be  considered.  Typically,  the  internal  auditor  reports  to 
the  senior  management  official,  or  to  the  board  of  directors. 
The  function  of  the  internal  auditor  is  to  independently  review 
the  implementation  of  controls  and  provide  reasonable  assurance 
to  senior  management  that  the  organization  is  functioning  ade- 
quately with  regard  to  legal  requirements,  management  policies, 
internal  controls,  audit  trails,  documentation,  and  economy  and 
efficiency. 

If  the  election  administration  cannot  fund  these  positions  full 
time,  then  discussions  could  be  held  with  other  agencies  of  the 
same  local  government  to  consider  the  possibility  of  jointly 
funding  the  positions.  The  local  government  could  consider 
itself  equivalent  to  the  department  for  which  a  complement  of 
positions  are  envisioned  in  the  reference  [90]   identified  above. 

State-level  support  for  these  positions  is  another  possibility. 
Joint  funding  or  State-level  support  might  engender  a  wide  review 
of  computer  security  policy  and  implementation  activity,  a  worth- 
while activity  in  any  event. 
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6.   DETAILED  CONCLUSIONS  AND  RECOMMENDATIONS 


The  conclusions  and  recommendations  presented  in  this  chapter 
cover  three  general  areas:  institutional  concerns;  hardware  and 
software  performance,  design,  and  integrity;  and  operational  pro- 
cedures. Institutional  concerns  are  considered  in  sections  6,1 
through  6.6.  Hardware  and  software  are  covered  in  sections  6.7 
through  6.12.  Operational  procedures  are  discussed  in  sections 
6.13  through  6.17.  In  the  final  section,  6.18,  the  recommenda- 
tions are  shown  to  be  responsive  to  specific  problems  of  comput- 
erized vote-tallying  identified  in  section  2.9. 

INSTITUTIONAL  CONCERNS 

6 . 1  The  Continuing  Problem  Of  Confidence  In  Results 

Consultants'  evaluations  of  a  vote-tallying  program,  quoted  in 
the  New  York  Times  article  on  July  29,  1985  [6],  as  well  as  tes- 
timony on  November  25,  1986  before  a  committee  of  the  Texas  leg- 
islature (section  2.8.3  above),  have  demonstrated  that  technical- 
ly trained  individuals  continue  to  find  significant  vulnerabili- 
ties in  vote-tallying  software  and  hardware.  Results  of  comput- 
erized elections  continue  to  be  challenged,  and  regardless  of  the 
outcomes  of  these  challenges,  it  has  been  clearly  shown  that  au- 
dit trails  that  document  election  results,  as  well  as  general 
practices  to  assure  accuracy,  integrity,  and  security,  can  be 
considerably  improved. 

Technically  qualified  consultants  employed  in  some  election  chal- 
lenges have  stated  that  "it  would  be  possible"  to  alter  computer 
programs  used  in  those  situations.  While  proof  of  actual  mani- 
pulation appears  to  be  lacking,  documentation  conclusively  demon- 
strating otherwise  is  insufficient,  due  to  the  manner  in  which 
the  challenged  elections,  and  others,  have  been  conducted. 

In  the  1975  vote-tallying  report,   it  was  stated  that: 

The  assurance  that  steps  are  being  taken  by  election 
officials  to  prevent  unauthorized  computer  program  al- 
teration or  other  computer-related  manipulations  re- 
mains, nationwide,  a  problem  for  the  maintenance  of 
public  confidence  in  the  election  process.  [91] 

Thus,  the  1975  statement  remains  pertinent. 

Given  the  continuing  problem,  it  is  important,  first,  to  identify 
the  agencies  responsible  for  correcting  the  deficiencies,  and 
second,  to  provide  recommendations  that  will  assist  these  agen- 
cies in  rectifying  the  situation. 
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6 . 2  Responsibility  And  Requirements  For  The  Effective  Management 


Of  Elections 


6.2.1  Government  Responsibility 

As  discussed  in  section  3.9.1,  responsibility  for  the  conduct  of 
elections  in  the  United  States  rests  with  local  governmental 
agencies  assigned  this  function  under  State  law  (or  under  local 
law,  under  a  grant  of  authority  by  State  law) .  It  was  stated  in 
that  section  that  major  elections  are  carried  out  by  about  2870 
county-level  government  agencies,  and  by  some  7  63  0  other  local 
governmental  agencies.  In  some  1005  of  the  total  3140  counties 
and  county-equivalents,  vote-tallying  is  completely  computerized. 
It  is  partly  computerized  in  an  additional  192  counties. 

Typically,  the  local  offices  operate  with  oversight  by  the  chief 
State  elections  official,  but  the  degree  of  oversight  varies  from 
State  to  State.  The  local  offices  of  election  administration  re- 
quire the  necessary  resources  and  expertise  to  efficiently  and 
effectively  carry  out  their  responsibility.  That  responsibility 
includes  procurement  of  supporting  equipment  and  services,  in- 
cluding vote-tallying  systems.  An  effective  procurement  must  in- 
clude specifications  (technical  descriptions  of  products  to  be 
procured)  so  that  accuracy,  integrity,  and  security  will  be 
promoted. 

6.2.2  Expertise  and  Effective  Management 

In  the  1975  vote-tallying  report,   it  was  noted  that: 

There  is  a  lack  of  expertise  in  computer  technology 
available  within  the  structure  of  many  local  election 
administrations.  In  jurisdictions  without  technologi- 
cal expertise,  vendors  are  more  likely  to  conduct  a 
significant  part  of  the  election  on  the  administra- 
tion's behalf.  [92] 

To  some  extent,  this  lack  of  expertise  continues  to  exist,  par- 
ticularly in  the  smaller  jurisdictions.  The  example  of  Elkhart 
County,  Indiana,  described  in  section  4.4.1,  is  a  glaring  in:- 
stance  of  the  problem. 

There  is  no  dispute  over  vendor  involvement  in  vote-tallying.  As 
was  testified  in  the  Texas  legislative  hearings  by  an  executive 
of  a  major  election  equipment  vendor  (section  2.8.3): 

"People  are  going  to  have  the  best  elections  that  well- 
intentioned  honest  people  can  run,  and  that  well-inten- 
tioned honest  companies  can  run...." 

Vendor  involvement  may  be  excessive  when  there  is  a  lack  of  local 
competence.     However,  vendor  goals  are  not  identical  to  those  of 
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the  responsible  public  officials.  Excessive  involvement  by  a 
vendor,  i.e.,  the  assumption  of  management  prerogatives,  may  be 
in  violation  of  GAO  standards  for  internal  control.  Pertinent 
GAO  standards  are  G3  (section  5.4.3),  and  S3  and  S5  (section 
5.4.5).     These  are: 

G3 .  Competent  Personnel :  Managers  and  employees  are  to 
have  personal  and  professional  integrity  and  are  to 
maintain  a  level  of  competence  that  allows  them  to  ac- 
complish their  assigned  duties,  as  well  as  understand 
the  importance  of  developing  and  implementing  good  in- 
ternal controls. 

S3.  Execution  of  Transactions  and  Events:  Transactions 
and  other  significant  events  are  to  be  authorized  and 
executed  only  by  persons  acting  within  the  scope  of 
their  authority. 

S5.  Supervision:  Qualified  and  continuous  supervision 
is  to  be  provided  to  ensure  that  internal  control  ob- 
jectives are  achieved. 

In  the  1975  vote-tallying  report,   it  was  concluded  that: 

Each  State  should  insure  that  each  of  its  local  juris- 
dictions possesses  the  necessary  expertise  in  computer 
technology  to  carry  out  its  statutory  election  func- 
tions and  does  not  rely  primarily  on  vendors  of  elec- 
tion system  components.  [93] 

This  recommendation  remains  pertinent,  and  now  is  buttressed 
with  internal  control  standards. 

Difficulties  with  vendor-supplied  products  used  in  vote-tallying 
are  often  indicators  of  a  lack  of  expertise  and/or  lack  of  ade- 
quate management  control  in  the  affected  agency.  In  one  of  the 
New  York  Times  articles  on  computerized  vote-tallying,  it  was  re- 
ported that  a  leading  computer  security  expert  had  stated  that: 

"the  degree  of  fraud  controls  built  into  a  program  is 
largely  determined  by  the  end  user."  [9] 

It  is  the  responsibility  of  the  State  and  local  election  adminis- 
trators (the  end  users)  to  ensure  that  requirements  for  adequate 
audit  trails  and  other  fraud-prevention  techniques  are  included 
in  the  specifications  to  be  met  by  acceptable  computerized  vote- 
tallying  systems. 

Failures  in  organizational  use  of  technology  often  indicate  fail- 
ures in  management.  In  the  Report  to  the  President  by  the  Presi- 
dential Commission  on  the  Space  Shuttle  Challenger  Accident  [94], 
it  was  recognized  that  the  immediate  cause  of  the  accident  was  a 
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failure  of  a  joint  of  a  rocket.  However,  deficiencies  in  manage- 
ment were  cited  as  causes  of  the  failure  to  correct  the  design 
defect.  The  Commission  reported  that  neither  the  contractor  nor 
the  government  agency  "responded  adequately  to  internal  warnings 
about  the  faulty  seal  design,"  that  "a  redefinition  of  the  Pro- 
gram Manager's  responsibility  is  essential,"  and  that  a  new  of- 
fice having  "direct  authority  for  safety,  reliability,  and  qual- 
ity assurance"  should  be  established. 

It  remains  true,  as  stated  in  the  1975  vote-tallying  report, 
that: 

Technology  and  the  management  of  technology  are  inex- 
tricably linked.  The  effective  use  of  technology  re- 
quires management  control;  and  the  effective  manage- 
ment of  technology  requires  the  utilization  of  appro- 
priate technological  expertise.  [95] 

6.2.3  Requirements 

If  each  office  of  election  administration  is  to  effectively  carry 
out  its  responsibilities,  it  must  have  in  place  the  necessary 
technological  expertise  and  management  control  systems.  These 
supporting  elements  are  most  urgently  needed  in  the  following 
three  areas:  (1)  procurement  of  vote-tallying  hardware  and  soft- 
ware, (2)  preparation  of  vote-tallying  systems  for  elections,  and 
(3)  execution  of  vote-tallying  operations.  To  the  extent  that 
local  administrations  cannot  acquire  the  necessary  knowledge  and 
personnel,   the  State-level  activity  should  provide  it. 

6.2.4  FEC  Clearinghouse  Performance  Specifications 

With  regard  to  procurements,  the  1975  vote-tallying  report  speci- 
fically recommended  statewide  specifications  [96].  The  FEC 
Clearinghouse  performance  specifications  [2]  [3]  are  approaching 
completion  (see  section  2.4),  and  they  are  intended  for  statewide 
adoption.  Each  State  should  consider  the  adoption  of  these  spec- 
ifications when  they  are  issued. 

6.3  Implementation  Of  An  Internal  Control  Function 

Concepts  of  internal  control  (as  extended  to  non-priced  opera- 
tions, described  in  chapter  5)  ,  should  be  utilized  by  election 
administrators  to  help  assure  accuracy,  integrity,  and  security 
in  elections.  Procedures  adopted  for  these  purposes  should  be 
consistent  with  and  supportive  of  the  GAO  internal  control  stan- 
dards presented  in  sections  5.4.3.  and  5.4.5.  Many  of  the  recom- 
mendations made  in  1975  could  have  been  classified  as  internal 
controls,  under  a  newer  interpretation  of  the  subject. 

Internal  control  expertise  should  be  added  to  the  personnel  com- 
plement   in   election   administration   to   assure   understanding  and 
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implementation  of  the  concepts.  Internal  control  is  a  profes- 
sional activity;  training  in  the  discipline,  texts,  and  a  commu- 
nity of  practitioners  are  available.  In  a  small  election  admi- 
nistration, the  internal  control  function  could  be  added  to  the 
duties  of  the  individual  responsible  for  implementation  of  com- 
puter security  controls,  provided  that  additional  training  is 
given. 

Additional  confidence  in  the  reported  results  of  elections  could 
obtained  if  an  internal  auditor  was  available  to  independently 
review  the  implementation  of  internal  controls  and  report  on 
their  effectiveness. 

Internal  control  personnel  could  be  shared  with  other  agencies  of 
the  same  government,  or  provided  by  the  State,  if  the  election 
administration  has  insufficient  resources  to  offer  full-time  em- 
ployment. 

6.3.1  Outside  Recommendations  vs.   In-house  Expertise 

Specific  procedural  recommendations  to  help  assure  accuracy,  in- 
tegrity, and  security  were  provided  in  the  1975  vote  tallying 
report,  and  similar  recommendations  are  provided  below.  However, 
the  failure  of  a  significant  number  of  election  administrations 
to  implement  the  1975  recommendations  is  indicative  of  the  need 
for  a  different  kind  of  answer. 

There  is  an  essential  qualitative  difference  between  the  availa- 
bility of  recommendations  made  in  an  outside  consultant's  report 
and  the  availability  of  in-house  professional  expertise  familiar 
with  the  necessary  body  of  knowledge.  Expertise  within  the  or- 
ganization provides  the  capability  to  deal  with  questions  of  ac- 
curacy, integrity,  and  security  on  a  day-to-day  basis,  to  evalu- 
ate outside  recommendations  for  feasibility  and  cost,  and  to  im- 
plement realistic  solutions  based  on  local  conditions  and  the  im- 
mediate situation. 

6.3.2  Achievement  of  Management  Goals 

The  involvement  of  an  internal  controls  officer  in  the  implemen- 
tation of  a  voting  system,  and  the  involvement  of  an  internal  au- 
ditor in  the  review  of  such  a  system,  will  provide  an  elections 
administrator  with  additional  capability  to  pursue  established 
goals.  The  involvement  of  internal  control  personnel  should  re- 
lieve the  elections  administrator  from  having  to  be  personally 
knowledgeable  about  specific  technical  matters  best  left  to  indi- 
viduals who  are  professionally  qualified  in  that  field.  With  the 
necessary  technical  expertise  on  staff,  an  elections  administra- 
tor can  retain  responsibility  for  direction,  and  can  perform  the 
required  supervisory  role  to  assure  that  established  goals,  such 
as  accuracy,   integrity,  and  security,  will  be  achieved. 
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6.3.3  Analysis  of  Risks  and  Impact  on  Public  Confidence 

An  important  function  of  internal  control  is  to  organize  the 
identified  system  vulnerabilities  into  a  set  of  realistic  threats 
and  responses.  This  activity  requires  the  performance  of  a  risk 
analysis  [81] .  The  analysis  involves  a  determination  of  the 
likelihood  of  actual  exploitation  of  a  particular  vulnerability, 
identification  of  the  potential  loss  or  negative  impact  from  the 
executed  threat,  and  development  of  proposed  countermeasures  that 
include  associated  costs.  A  risk  analysis  would  consider,  for 
example,  the  possibility  that  "computers  can  be  manipulated  re- 
motely, by  wire  or  radio"  or  that  "the  software  can  be  set  to 
await  the  receipt  of  a  special  card,  whose  presence  will  cause 
all  the  election  counters  to  be  altered"  (threats  specifically 
identified  in  public  testimony) . 

The  result  of  a  risk  analysis  and  its  follow-on  activities  would 
satisfy  two  needs.  These  needs  are,  first,  for  actual  system 
protection  plans,  and  second,  for  assurances  that  could  made  to 
the  public  that  the  potential  threats  are  understood,  have  been 
prioritized  for  significance,  and  are  being  countered  with  avail- 
able measures  consistent  with  resources. 

Internal  control  personnel  would  be  extremely  valuable  in  re- 
sponding to  questions  about  accuracy,  integrity,  and  security 
raised  by  supporters  of  defeated  candidates  or  by  technically 
trained  members  of  the  general  public.  The  involvement  of  pro- 
fessionally qualified  internal  control  personnel  should  provide 
the  general  public  with  additional  confidence  that  a  computerized 
election  with  which  these  personnel  have  been  connected  has  been 
carried  out  fairly  and  accurately. 

6 . 4  Review  Of  The  Adequacy  Of  State  Laws  And  Regulations 

Each  State  should  examine  the  adequacy  of  its  laws  and  regula- 
tions to  assure  their  effectiveness  in  treating  problems  of  ac- 
curacy,  integrity,  and  security  in  computerized  vote-tallying. 

6.4.1  Revised  Texas  Statute  on  Electronic  Voting  Systems 

At  a  minimum,  the  requirements  of  the  revised  Texas  statute  on 
electronic  voting  systems  should  be  considered  for  adoption  in 
those  States  that  have  not  already  adopted  equivalent  provisions. 
Provisions  of  the  Texas  statute  include  requirements  for  audit 
trails,  deposit  of  computer  programs  with  the  secretary  of  state, 
assurance  that  the  programs  used  in  vote-tallying  are  identical 
to  those  deposited,  mandatory  one  percent  manual  recount  of  all 
contests,  testing  of  equipment  using  all  applicable  ballot  for- 
mats, disconnect  of  remote  terminals  during  vote  tabulation,  and 
specific  scrutiny  of  ballot  count  discrepancies  when  they  occur 
at  precinct  locations   (see  section  2.8.4). 
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6.4.2  Effective  Use  of  Technical  Terminology 

In  connection  with  the  examination  of  laws  and  regulations,  a  re- 
view should  be  undertaken  of  the  technical  terminology  employed. 
The  latter  review  should  assure  that  the  use  of  such  terminology 
is  clear,   and  is  consistent  with  current  concepts. 

6 . 5  Future  Vote-Tallying  Systems 

While  vote-tallying  using  on-line  systems  (e.g.,  through  tele- 
phones or  stations  similar  to  automatic  teller  machines)  is  tech- 
nologically feasible,  the  decision  to  implement  such  systems  must 
be  based  on  more  fundamental  factors.  The  principal  issues 
should  be  political  and  social  concerns,  as  well  as  concerns  for 
the  benefits  compared  with  the  costs. 

Any  installed  system  must  meet  several  basic  political  require- 
ments, in  addition  to  technical  requirements  of  accuracy  and  re- 
liability. The  political  requirements  include  equal  access  by 
individuals  to  the  voting  franchise,  the  ability  to  verify  regis- 
tration, the  ability  of  voters  to  vote  in  secret  without  intimi- 
dation, assurance  of  fairness  to  opposing  parties,  and  the  abil- 
ity to  demonstrate,  through  audit  trails  and  other  internal  con- 
trols, that  the  announced  results  are  correct.  The  benefits  of 
the  use  of  the  advanced  technology  might  be  greater  convenience 
to  voters  and  possibly  greater  participation.  However,  the  costs 
of  providing  the  capacity  for  very  high  traffic  over  a  short  time 
span  might  be  prohibitive. 

6 . 6  Transfer  Of  Technical  Knowledge  To  Election  Officials 

Technical  knowledge  that  can  be  collected  and  made  available  on  a 
national  basis  needs  to  be  transferred  to  election  officials. 
The  activity  of  information  dissemination  being  carried  out  by 
the  Election  Center  (see  section  2.5)  should  be  expanded.  Elec- 
tion officials  need  sources  of  knowledge  in  new  and  improved 
techniques  of  management,  including  those  that  would  assist  in 
the  solution  of  problems  of  procurement  and  operations.  The  need 
for  sources  of  technical  knowledge  has  been  previously  recog- 
nized: 

"State  election  officials  agree  generally  on  the  need 
to  upgrade  election  procedures  by  providing  more  tech- 
nical guidance  to  local  officials,  particularly  in  such 
areas  as  the  utilization  of  electronic  data  processing 
techniques."  [97] 

HARDWARE  AND  SOFTWARE  PERFORMANCE.    DESIGN,    AND  INTEGRITY 

6.7  Adoption  Of  EEC  Clearinghouse  Concepts  For  Product  Acceptance 
Acceptance  procedures  for  hardware  and  software  should  be  consis- 
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tent  with  the  FEC  Clearinghouse  implementation  plan  [4]  involving 
qualification  and  certification  prior  to  final  acceptance.  Qual- 
ification implies  conformance  with  standards  and  functional  re- 
quirements. It  may  be  done  for  a  vendor  by  an  independent  test- 
ing laboratory  in  order  to  satisfy  the  requirements  of  many 
States  with  a  single  set  of  tests.  Certification  is  a  State  ap- 
proval process ;  it  ensures  that  the  product  meets  State  require- 
ments. Acceptance  testing  is  performed  at  the  local  government 
level;  it  evaluates  the  degree  to  which  the  specific  units  deliv- 
ered conform  to  the  characteristics  of  the  product  that  were  ap- 
proved under  qualification  and  certification. 

6 . 8  Software  Certification.   Performance.  And  Integrity 

6.8.1  Certification  of  Software 

Products  to  be  certified  should  include  all  software  that  is  to 
be  used  in  connection  with  vote-tallying.  This  software  includes 
operating  systems,  compilers,  and  other  utility  programs  that  run 
with  application  programs.  Application  programs  include  software 
for  specializing  vote-tallying  programs  for  a  particular  elec- 
tion, and  the  vote-tallying  programs  themselves.  The  software 
should  include  system  programs  that  compile  source  application 
programs  to  object  code.  If  an  election  management  package  is  to 
run  on  a  computer  at  the  same  time  as  specialization  or  vote-tal- 
lying software,  that  package  should  be  certified  at  the  same 
time. 

6.8.2  Requirements  for  Certification 

Requirements  for  certification  should  include  one  type  of  assur- 
ance for  all  software  and  a  second  type  only  for  vote-tallying 
software.  All  software  should  be  checked  for  integrity,  that  is, 
for  the  ability  to  carry  out  its  asserted  function  and  to  contain 
no  hidden  code.  Vote-tallying  software  should  be  tested,  in  ad- 
dition, for  logical  correctness.  Software  testing  may  be  part  of 
a  qualification  process,  done  once,  that  is  acceptable  to  many 
States . 

6.8.3  Integrity  of  Software 

Separate  copies  of  all  computer  software,  such  as  the  operating 
system,  compiler,  and  other  needed  utility  programs,  as  well  as 
vote-tallying  software,  should  be  obtained  from  general  suppliers 
from  a  stock  of  publicly  offered  products,  or  should  be  written 
in-house.  With  each  procured  software  product,  complete  documen- 
tation of  its  functions  should  be  obtained.  Assurances  should  be 
received  from  each  supplier  that  the  copies  obtained  perform  no 
other  function  than  that  stated  in  documentation  of  the  products. 

Assurances  may  be  simple  written  statements,  or  detailed  state- 
ments specifying  the  function  of  each  major  program  segment.  In 
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addition,  tests  may  be  performed  to  demonstrate  the  correctness 
of  the  assertions. 

For  support  software,  such  as  operating  systems,  available  re- 
sources may  limit  the  tests  that  can  be  performed  to  assure  in- 
tegrity. Qualification,  done  once  to  satisfy  many  States,  may 
enable  testing  resources  to  stretch  further.  If  available  re- 
sources severely  restrict  integrity  testing,  written  statements 
by  the  manufacturer  and  documentation  of  functions  may  be  all  the 
assurance  that  can  be  achieved.  Thus,  reliability  and  account- 
ability of  the  sources  are  essential.  Copying  of  software  from 
unaccountable  sources  must  be  forbidden. 

6.8.4  Dedicated  Operation  and  Use 

An  important  procedure  to  assure  system  integrity  is  to  isolate 
vote-tallying  and  support  software  from  influences  over  which  the 
election  administration  has  no  control. 

Any  routine  (even  a  simple  routine  used  to  copy  files)  that  oper- 
ates on  any  vote-tallying  program  should  be  maintained  separately 
under  the  control  of  the  election  administration  and  not  used  for 
any  other  purpose  except  in  connection  with  vote-tallying. 

When  vote-tallying  software  is  run  on  a  general-purpose  computer 
in  which  there  is  no  control  over  the  other  applications  or  sup- 
port software  that  are  also  being  run,  a  review  for  hidden  code 
is  not  useful.  Hidden  code  may  be  present  in  other  software  that 
is  not  reviewed,  and  may  be  transferred  to  the  vote-tallying 
software  as  a  "computer  virus."  Thus,  it  is  strongly  recommended 
that  vote-tallying  software  not  be  allowed  to  run  on  a  multipro- 
grammed  general-purpose  computer.  The  restriction  to  dedicated 
operation  and  use  were  recommended  in  the  1975  vote-tallying 
report.  [98] 

For  vote-tallying  with  DRE  machines,  running  of  any  software  re- 
lated to  vote-tallying  together  with  other  software  that  has  not 
been  reviewed  for  hidden  code  should  be  prohibited.  With  DRE 
systems,  freedom  from  hidden  code  of  all  software  associated  in 
any  way  with  vote-tallying  must  be  guaranteed.  There  are  no  bal- 
lots that  can  be  recounted  as  a  check  on  system  correctness. 

6.8.5  Logical  Correctness  of  Vote-Tallying  Software 

For  vote-tallying  software  (including  software  for  election  spe- 
cialization and  ballot  generation,  as  well  as  vote-summarizing 
software) ,  certification  implies  assurance  of  logical  correct- 
ness: for  example,  in  implementation  of  ballot  position  assign- 
ments in  ballot  generation,  in  translation  of  voters'  choices  to 
storage,  in  summation  of  voters'  choices  regardless  of  rotation, 
and  in  implementation  of  State  logical  rules  such  as  for  over- 
voting  and  crossover  voting.     No  requirement  for  certification  of 
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logical  correctness  is  implied  for  other  types  of  software. 

6.8.6  Design  for  Specialization  and  Prevention  of  Logic  Changes 

After  software  has  been  certified,  no  changes  should  be  permitted 
without  a  re-certification.  Vote-tallying  software  should  be  de- 
signed so  as  to  require  that  specialization  occur  only  by  a 
" f ill-in-the-blanks"  process  in  tables.  This  concept  was  pre- 
sented in  the  1975  vote-tallying  report  under  "Use  of  Table- 
Driven  Programs."  [99] 

It  should  be  noted  that  the  use  of  "header  cards"  in  vote-tally- 
ing operations  constitutes  part  of  the  specialization  process. 
Data  provided  to  the  program  by  header  cards  should  only  fill  in 
blanks  in  tables  and  should  not  change  program  logic.  As  noted 
in  the  1975  vote-tallying  report,  a  complete  audit  trail  of  oper- 
ations would  have  to  include  "capability  to  copy  out  on  the  out- 
put printer  the  exact  contents  of  each  header  and  other  control 
card  read  at  the  input..."  [100] 

6.8.7  Deposit  and  Availability  of  Certified  Software 

All  software  that  has  been  certified  should  be  deposited  with  the 
chief  election  official  of  the  State.  The  materials  on  file 
should  not  be  public  information,  but  should  be  made  available  to 
law  enforcement  authorities,  on  proper  application,  for  inves- 
tigation of  election  irregularities. 

6 . 9  Accuracy  Of  Ballot  Reading 

The  problems  found  in  ballot  reader  inaccuracy,  both  in  the  count 
of  ballots,  and  in  the  count  of  votes  on  the  ballots,  are  a  sig- 
nificant source  of  lack  of  confidence  in  vote-tallying  by  candi- 
dates and  informed  observers.  The  use  of  pre-scored  punch  card 
ballots  contributes  to  the  inaccuracy  and  to  the  lack  of  confi- 
dence. In  every  case  reported  in  chapter  4  in  which  a  recount 
was  taken  using  pre-scored  punch  card  ballots,  the  second  vote 
count  differed  somewhat.  It  is  generally  not  possible  to  exactly 
duplicate  a  count  obtained  on  pre-scored  cards,  given  the  inher- 
ent physical  characteristics  of  punch  card  ballots  and  the  varia- 
bility in  the  ballot  punching  performance  of  real  voters. 

The  statements  made  in  the  1975  vote-tallying  report  about  the 
need  for  ballot  reader  accuracy  included  the  following: 

The  sensor  [i.e.,  ballot  reader],  the  device  which  con- 
verts information  on  a  ballot  to  electronic  form  for 
data  processing,  is  one  of  the  key  elements  of  a  com- 
puter-based vote-tallying  system.  Its  accuracy,  relia- 
bility,   and  stability  over  time  must  be  assured  

Sensor  accuracy  must  be  considered  in  combination  with 
the  quality  of  its  data  input  which  the  voters  are  able 
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to  achieve  given  particular  forms  of  ballots  and  vote- 
encoding  equipment.  .  .  .  The  effect  of  a  sensor  on  the 
information  contained  on  a  ballot  must  be  minimal  when 
the  ballot  is  read.  This  is  extremely  important  if  a 
ballot  must  be  re-read  or  recounted.  [101] 

These  statements  continue  to  be  pertinent. 

Therefore,  the  following  recommendations  are  made: 

6.9.1  Accuracy  Goal 

A  recommended  goal  for  computerized  vote  counting  is  that  the 
vote  count  produced  on  a  computerized  ballot-tallying  system 
should  be  able  to  be  reproduced  on  a  recount  with  no  more  than  a 
change  in  one  vote  for  each  candidate  or  issue  alternative  in 
ballot  quantities  of  up  to  100,000  when  machine-generated  (ideal) 
ballots  are  used.  The  ballot  reader  should  be  able  to  tolerate  a 
wide  range  of  voter  punching/marking  behavior  without  a  signifi- 
cant increase  in  error. 

6.9.2  Elimination  of  Pre-scored  Punch  Card  Ballots 

The  use  of  pre-scored  punch  card  ballots  should  be  ended. 

One  method  now  available  to  eliminate  pre-scored  cards,  while 
retaining  the  "votomatic"  concept,  is  with  a  new  type  of  stylus. 
This  stylus  permits  a  voter  to  create  a  hole  of  consistent  dimen- 
sions in  a  ballot  card  without  the  need  for  pre-scoring.  A  re- 
placement for  the  internal  construction  of  the  "votomatic"  ballot 
holding  device  must  be  installed  in  conjunction  with  the  use  of 
the  new  type  of  stylus.  Other  devices  and  methods  for  elimina- 
tion of  pre-scored  punch  card  ballots  also  may  be  effective. 

6.9.3  Treatment  of  Rejected  Ballots 

Some  ballot  readers  (primarily  mark-sense  readers)  include  a  "go- 
no-go"  decision,  depending  on  whether  the  reader  can  read  the 
ballot  at  all.  Such  readers  may  refuse  to  count  ballots  in  the 
"no-go"  status.  Administrative  regulations  should  require  such 
rejected  ballots  to  be  counted  manually,  so  that  no  voter  loses 
the  voting  franchise  because  of  machine  failure. 

The  use  of  the  term  "rejected  ballots,"  implies  that  none  of  the 
ballot  readers  used  could  distinguish  a  hole  from  no-hole  or  mark 
from  no-mark  at  a  location  on  a  ballot  at  which  a  hole  or  mark 
indicates  an  intention  to  cast  a  vote.  If  a  ballot  reader  can 
correctly  distinguish  the  voting  intentions  made  by  the  voter  in 
all  the  appropriate  locations  on  the  ballot,  it  is  successfully 
reading  the  ballot  (even  if  a  voting  intention  cannot  be  counted 
because  of  an  overvote  or  the  voter  submitted  an  undervote  by 
failing  to  vote  for  an  office) .     If  the  ballot  is  correctly  read. 


111 


the  term  "rejected  ballots"  should  not  be  used. 
6.9.4  Required  Research 

Research  to  determine  the  accuracy  of  current  ballot  reading  sys- 
tems (such  as  that  now  being  carried  out  by  ECRI  of  Plymouth 
Meeting,  PA) ,  and  additional  research  to  improve  ballot  tallying 
systems  from  the  standpoints  of  both  accuracy  and  ease  of  voter 
use,  are  important  to  pursue.  The  need  for  such  research  was 
recognized  in  1975.  [102] 

6.10  Design  Of  PRE  Machines 

As  no  voter-generated  records  of  voters'  choices  exist  with  the 
use  of  ORE  machines,  and  no  recount  of  voters'  choices  is  possi- 
ble, additional  steps  should  be  taken  with  these  machines  to  as- 
sure confidence  in  the  reported  results. 

6.10.1  Recording  of  Each  Undervote 

It  is  recommended,  therefore,  that  each  ORE  machine  be  designed 
so  as  to  take  a  positive  action  for  every  contest  in  which  the 
voter  fails  to  vote  the  maximum  number  of  times  permitted.  The 
positive  action  should  be  the  recording  of  a  "no  vote"  for  each 
undervote.  In  a  vote-for-two  contest,  for  example,  if  the  voter 
only  votes  for  one  candidate,  the  machine  should  cast  one  "no 
vote."  In  a  vote-for-two  contest,  if  the  voter  fails  to  vote  at 
all,  the  machine  should  cast  two  "no  votes."  The  machine  should 
be  designed  to  take  this  action  only  when  the  voter  indicates  to 
the  machine  that  voting  choices  are  complete. 

The  "no  vote"  should  be  recorded  for  each  separate  contest,  so 
that  if  a  voter-choice  set  is  retained,  the  presence  of  each  "no 
vote"  should  be  clearly  present  as  a  separate  indication.  That 
is,  the  "no  votes"  should  not  be  computed  in  summary  form  as  the 
difference  of  the  maximum  number  of  votes  possible  less  the  ac- 
tual number  of  votes  cast.  (If  there  is  an  actual  "none  of  the 
above"  possibility  for  voter  consideration,  as  is  the  case  in  at 
least  one  State,  the  voter  still  may  fail  to  select  it  or  other- 
wise make  any  candidate  selection.) 

The  implementation  of  the  positive  "no  vote"  indicator  may  be 
better  explained  if  the  ORE  function  of  precisely  recording  the 
voter's  choices  is  considered  to  consist  of  two  substeps.  The 
first  of  these  substeps  consists  of  the  setting  of  indicators 
seen  by  the  voter  in  response  to  the  voter's  particular  selec- 
tions. If  the  machine  is  initially  set  up  for  voter  use  so  that 
each  contest  has  a  number  of  "no  vote"  indicators  equal  to  the 
maximum  number  of  allowable  votes  in  the  contest,  the  voter's 
actions  can  be  logically  treated  as  replacing  each  "no  vote"  in- 
dicator, one  at  a  time,  with  an  actual  candidate  or  issue  alter- 
native selection.      (The  "no  vote"  indicators  need  not  be  seen  by 
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the  voter.)  If  the  voter  fails  to  vote  the  maximum  times  allowed 
for  the  ballot  configuration,  some  "no  vote"  indicators  will  re- 
main when  the  voter  indicates  to  the  machine  that  voting  is  com- 
plete. 

The  second  substep  occurs  immediately  after  the  voter  indicates 
that  voting  is  complete;  it  consists  of  the  transfer  of  the  set 
of  selections  to  a  more  permanent  storage.  At  that  time,  the  re- 
maining "no  vote"  indicators  that  were  not  replaced  would  be 
transferred  to  permanent  storage  with  the  actual  candidate  and 
issue  alternative  selections.  The  sum  of  the  number  of  actual 
votes  and  "no  votes"  transferred  would  have  to  be  the  same  quan- 
tity for  every  voter  using  the  same  ballot  style.  The  presence 
of  this  constant  quantity  for  each  voter  would  provide  support 
for  the  supposition  that  the  second  substep  operated  correctly, 
i.e.,  that  the  indicators  resulting  from  the  first  substep,  in- 
cluding both  actual  voters'  choices  and  unreplaced  "no  votes," 
were  actually  transferred  to  permanent  storage. 

The  design  of  a  DRE  machine  in  this  manner  will  provide  addition- 
al confidence  that,  when  an  undervote  is  seen  in  the  results,  the 
undervote  is  actually  due  to  the  voter's  choice  not  to  vote,  in- 
stead of  the  machine's  failure  to  record  the  voter's  choice.  The 
design  will  provide  a  distinct  improvement  over  the  situation 
with  a  lever  machine.  In  the  use  of  a  lever  machine,  it  is  not 
possible,  without  an  examination  of  the  internal  operation  of  the 
mechanism,  to  distinguish  a  voter's  failure  to  vote  from  the  ma- 
chine's failure  to  record  a  vote. 

The  constant  value  of  the  sum  of  the  number  of  unreplaced  "no 
votes"  and  the  number  of  votes  for  candidates  and  issue  alter- 
natives, provides  the  capability  of  an  arithmetic  cross-check  on 
the  action  of  the  machine  (see  section  6.17.3). 

6.10.2  Retention  of  Voter-Choice  Sets 

Each  voter-choice  set  (i.e.,  the  machine's  record  of  all  choices 
of  a  voter)  should  be  retained  in  the  machine  on  a  removable, 
non-volatile  medium,  for  example,  magnetic  disk.  Storage  loca- 
tions of  the  voter-choice  sets  would  have  to  be  randomized  to 
prevent  association  of  a  particular  set  of  choices  with  a  parti- 
cular voter.  The  retention  of  the  voter-choice  sets  makes  possi- 
ble a  verification,  on  an  independent  machine,  of  the  DRE  ma- 
chine's summation  of  its  recorded  voters'  choices  (see  section 
6.17.4).  This  verification  only  checks  the  summation  process;  it 
does  not  check  the  data  entry  process.  By  design,  there  can  be 
no  independent  verification  of  the  data  entry  process.  The 
latter  can  be  checked  only  by  testing  the  machine's  response  to 
known  inputs  (see  section  6.17.5). 
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6.10.3  Accuracy  of  DRE  Machines 


Analogously  with  ballot-tallying  machines,  an  accuracy  goal  can 
be  established  for  DRE  machines.  For  a  statistical  test  of  ac- 
curacy, a  device  simulating  a  large  number  of  voter  selections 
could  be  used.  The  test  would  verify  that  a  selection  of  any 
ballot  position  translates  to  a  correct  machine-produced  result. 

A  goal  analogous  to  that  stated  for  ballot-tallying  machines  is 
that  for  known  selections  made  in  up  to  100,000  ballots  cast, 
there  should  be  a  discrepancy  of  no  more  than  one  vote  in  the 
results  provided  for  any  ballot  position. 

6.11  Certification  Of  DRE  Hardware  Logic 

As  there  are  no  independent  ballots  that  can  be  recounted  in  a 
DRE  system,  it  is  essential  to  assure  that  DRE  hardware  logic,  as 
well  as  its  software,  is  correct.  DRE  hardware  should  be  certi- 
fied for  logical  correctness,  by  examination  of  the  logic  design 
and  by  testing  under  a  large  variety  of  different  conditions.  A 
typical  unit  and  its  documentation  should  be  deposited  with  the 
State,  under  the  conditions  specified  in  section  6.8.7. 

6.12  Selection  Of  A  Vote-Tallying  System 

The  discussion  of  chapter  3  above  has  demonstrated  that  every 
type  of  vote-tallying  system  has  its  vulnerabilities.  Every  type 
of  vote-tallying  system  has  relative  advantages  and  disadvan- 
tages. 

It  is  possible  to  effectively  utilize  any  of  the  computerized 
systems  discussed  in  chapter  3  provided  that: 

(a)  procurement  specifications  are  well-written  in  accord- 
ance with  required  performance,  including  considerations  of  accu- 
racy,  reliability,   and  recommended  design  concepts; 

(b)  certification  and  acceptance  tests  are  designed  so  that 
only  an  acceptably  performing  system  is  acquired; 

(c)  the  vote-tallying  system  (including  personnel  and  back- 
up)  is  adequately  prepared,  tested,   and  put  in  readiness; 

(d)  standard  procedures  and  recommended  internal  controls 
(including  audit  trails  and  integrity  controls)  are  in  place  for 
voting  and  vote-tallying  operations;  and 

(e)  administrative  regulations  have  been  designed  and  are  in 
place  to  deal  with  expected  activities,  as  well  as  with  any  con- 
tingencies that  might  arise. 

OPERATIONAL  PROCEDURES 

6.13  Pre-Election  Checkout 

Lack    of    sufficient    pre-election   testing   appears   to   be   a  major 
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source  of  current  operational  difficulty.  The  Illinois  State 
Board  of  Elections,  based  on  their  investigations,  called  for 
'"extensive"  pre-election  testing,  and  reported  that  "the  testing 
of  computer  vote  tabulation  systems  needs  to  be  improved  substan- 
tially" (see  section  4.6).  This  recommendation  should  be  heeded 
by  election  administrators.  As  was  pointed  out,  similarly,  in 
the  1975  vote-tallying  report: 

To  the  greatest  extent  possible,  all  hardware  and  soft- 
ware to  be  utilized  should  be  given  a  dry  run  simulat- 
ing specific  conditions  to  be  faced  on  election  day  and 
election  night.  [103] 

Sufficient  pre-election  testing  should  be  applied  so  that  errors 
in  software  specialization  or  in  implementation  of  logical  rules, 
if  any,  will  become  obvious.  A  large  variety  of  possible  voting 
combinations  should  be  tested.  A  dry  run  involving  key  personnel 
is  valuable,  particularly  in  the  first  use  of  a  new  system. 

Adoption  of  the  testing  clause  from  the  revised  Texas  statute  on 
electronic  voting  systems  (see  section  2.6.4)  is  recommended  as  a 
minimum  standard.  The  statute  states  that  "each  unit  of  automat- 
ic tabulation  equipment  shall  be  tested,  using  all  applicable 
ballot  formats. . . " 

6 . 14  Implementation  Of  Audit  Trails 

Two  types  of  audit  trails  must  be  distinguished.  One  type  re- 
cords steps  in  the  operation  of  computing  equipment  (both  the 
operation  of  central  equipment  by  computer  operators  and  the  op- 
eration of  precinct-located  equipment  by  precinct  officials) . 
The  second  type  records  steps  in  the  execution  of  the  voting  pro- 
cess and  includes  all  steps  from  the  printing  and  distribution  of 
blank  ballots,  through  collection  and  processing  of  voted  bal- 
lots, to  the  summarization  of  precinct  results. 

Principles  of  internal  control  require  that  both  types  of  audit 
trails  be  maintained.  The  following  statement  in  the  revised 
Texas  statute  on  electronic  voting  systems  is  strongly  supported: 

"A  voting  system  may  not  be  used  in  an  election  unless 
the  system  ...  is  capable  of  providing  records  from 
which  the  operation  of  the  voting  system  may  be  audit- 
ed. " 

Audit  trails  provide  much  of  the  documentation  through  which  the 
correctness  of  the  reported  results  may  be  verified. 

6.14.1  Full  Ballots-Cast  Data  from  Split  Precincts 

A  "split  precinct"  is  a  precinct  in  which  more  than  one  ballot 
style   is  used.      As  certain  contests  might  appear  on  some  ballot 
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styles  but  not  on  others,  it  is  important  to  report  ballots-cast 
data  and  corresponding  voter  participation  data  for  each  split. 
A  complete  audit  trail  for  each  contest  is  obtained  only  with  the 
reporting  of  such  data.  Complete  reporting  may  be  simply  accom- 
plished by  designating  each  split  a  separate  precinct,  or  special 
arrangements  may  be  made  to  report  split  data  from  a  single  pre- 
cinct. It  may  simplify  the  voter  sign-in  process  and  the  report- 
ing of  voter  participation  if  there  are  separate  precincts.  The 
precincts  may  continue  to  be  located  at  the  same  polling  place. 

6 . 15  Access  Controls 

6.15.1  Site  Controls 

Controls  must  be  in  place  to  restrict  access  of  persons  to  sites 
or  parts  of  sites  where  computing  equipment,  blank  ballots,  voted 
ballots,  and  signature  lists  are  located.  This  includes  loca- 
tions at  precincts  where  computers,  DRE  machines,  and  election 
supplies  are  stored  in  preparation  for  use. 

6.15.2  Equipment  Access  Controls 

Controls  should  further  restrict  access  to  equipment  (both  cen- 
tral and  precinct-located)  for  operation  or  maintenance  to  desig- 
nated individuals.  Controls  on  access  to  equipment  should  pre- 
vent removal  or  tampering  with  portable  components,  e.g.,  plug-in 
read-only  memories,  removable  magnetic  tapes  or  disks,  plug-in 
circuit  boards,  etc. 

6.15.3  Transportation  and  Handling  Controls 

Access  to  the  transportation  and  handling  of  signature  lists, 
blank  ballots,  voted  ballots,  and  removable  read-only  memories 
containing  programs  and  election  data,  must  be  controlled. 

6.15.4  Voting  Process  Controls 

At  locations  where  voting  takes  place,  controls  should  assure  an 
orderly  flow  of  voters,  not  only  to  assist  voters  to  quickly  and 
efficiently  complete  the  process,  but  for  security  purposes. 
Controls  should  assure  that  no  voter  or  other  person  can  tamper 
with,  replace,  or  deface  a  "votomatic"  ballot  insert,  "datavote" 
ballot  punch,  or  DRE  ballot  display,  or  carry  away  a  mark-sense 
marking  pencil,  "votomatic"  stylus,  information  display,  or  any 
other  equipment  or  supplies  needed  for  voting.  In  ballot-tally- 
ing systems,  controls  should  assure  that  only  registered  voters 
receive  ballots,  and  that  each  voter  receives  only  one  ballot  and 
votes  the  ballot  given.  In  DRE  systems,  equivalently ,  controls 
should  assure  that  only  registered  voters  have  access  to  the  ma- 
chines, and  that  each  voter  votes  only  once. 
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6.15.5  Telecommunications  Security  Controls 

If  voting  data  are  transmitted  from  a  remote  to  a  central  loca- 
tion, controls  must  be  in  place  to  assure  the  security  of  the 
process.  The  "dial-out  only"  procedure,  in  which  the  central  lo- 
cation dials  out  and  verbal  communication  establishes,  through 
name  and  password,  that  the  person  at  the  remote  location  is  the 
responsible  individual,  is  satisfactory  for  establishing  the  con- 
nection from  the  central  location  to  the  remote  location.  More 
complex  controls  have  been  given  in  a  previously  cited  reference 
[31]  .  If  results  are  to  be  transmitted  before  the  polls  are 
closed,  or  if  individual  votes  are  to  be  transmitted,  or  if  the 
data  transmitted  is  to  be  considered  official,  then  controls  to 
secure  the  content  of  the  message  must  be  employed.  The  computer 
data  authentication  process  previously  referenced  [34]  should  be 
used. 

While  concern  for  the  security  of  transmission  is  included  in 
this  section  as  an  access  control,  assurance  of  the  accuracy  of 
transmission  is  considered  to  be  an  application  internal  control. 

6.16  Application  Internal  Controls  For  Ballot-Tallying  Systems 

The  controls  in  this  section  are  similar  to  those  proposed  in  the 
1975  vote-tallying  report  under  the  headings  of  aids  to  audit  of 
calculations,  effective  control  of  ballots  and  computer  hard-copy 
records,   and  use  of  teleprocessing  [104]. 

6.16.1  Controls  over  Blank  Ballots  Printed  and  Distributed 

A  significant  problem  in  ballot-tallying  systems  is  the  protec- 
tion of  the  system  against  all  types  of  ballot  frauds.  Controls 
must  be  instituted  over  the  number  of  blank  ballots  printed  and 
the  number  of  blank  ballots  distributed  to  each  polling  location. 
Documentary  evidence  of  these  activities  should  be  retained. 

6.16.2  Numbering  of  Ballot  Stubs 

One  way  of  assuring  better  control  over  ballot  distribution  is  to 
have  the  ballot  stubs  numbered  and  assembled  in  groups  (e.g., 
fifty  or  one  hundred) .  The  assignments  of  ballot  groups  to  each 
polling  location  should  be  recorded.  The  individual  ballot  stub 
number  may  be  recorded  by  a  precinct  official  when  a  ballot  is 
issued  to  a  voter.  The  stub  number  is  used  to  assure  that  the 
ballot  to  be  voted  is  the  same  one  issued. 

6.16.3  Controls  over  Ballot  Use 

The  number  of  voted  ballots  (of  each  individual  type,  in  case 
each  voter  is  issued  more  than  one  type)  ,  must  equal  the  number 
of  voters  that  were  issued  ballots  (i.e.,  signed  in  to  vote).  At 
each   precinct,    the   number   of   blank   ballots    initially  received 
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must  be  equal  to  the  sum  of  the  ballots  returned  in  all  catego- 
ries (e.g.,  voted,  voted  but  challenged,  spoiled,  and  unused). 
When  the  ballots  from  all  precincts  are  returned  to  the  adminis- 
trative center,  the  total  number  of  all  ballots  returned  in  all 
categories  (plus  the  number  unreturned  by  absentees)  should  equal 
the  total  number  of  all  ballots  distributed  to  all  precincts  and 
to  absentees. 

6.16.4  Control  of  Ballot  Validity 

Ballots  may  be  watermarked  or  otherwise  made  distinctive  to  guard 
against  counterfeiting.  Procedures  used  by  the  manufacturer  and 
vendor  of  the  ballots  should  be  reviewed  for  security. 

6.16.5  Machine-readability  of  Ballot's  Precinct  Number 

Machine-readability  of  the  precinct  number  assists  in  the  preven- 
tion of  ballots  from  one  precinct  being  mixed  with  or  exchanged 
with  ballots  of  another  precinct.  The  computer  counting  the 
votes  must  be  programmed  to  read  the  precinct  number  and  make  ef- 
fective use  of  it,  if  the  machine-readable  identification  is  to 
have  any  value. 

This  check  is  extremely  important  if  "votomatic"  cards  are  used, 
particularly  if  ballot  rotation  (i.e.,  different  candidate  se- 
quencing in  different  precincts)  is  employed,  or  if  counting  of 
ballots  of  more  than  one  ballot  style  is  done  at  the  same  physi- 
cal location.  If  equal  numbers  of  "votomatic"  ballots  (ballots 
having  no  candidate  information  on  them)  were  exchanged  between 
precincts  using  different  rotations,  and  a  check  of  precinct  num- 
bers were  not  done,  the  mistake  would  not  be  discovered  by  a  bal- 
lot count  reconciliation.  The  correct  number  of  ballots  would  be 
found  for  each  precinct. 

The  programmed  check  of  the  ballot's  precinct  number  also  reduces 
the  importance  of  correct  computer  operator  action  in  processing 
the  ballots.  With  a  computerized  check  of  precinct  number,  it  is 
not  necessary  for  the  operator  to  insert  a  "header  card"  with 
this  information  on  it,  provided  that  the  ballot  style  for  the 
precinct  is  already  recorded  in  the  computer.  If  ballot  style 
were  used  as  the  machine-readable  value,  the  use  of  a  "header 
card"  would  still  be  necessary  to  enable  a  precinct-by-precinct 
count,  if  more  than  one  precinct  employed  the  same  ballot  style. 
The  possibility  of  operator  error  in  using  an  incorrect  "header 
card"  is  eliminated  only  with  use  of  the  machine-readable  pre- 
^      cinct  number. 

6.16.6  Accuracy  of  Telecommunication  of  Voting  Data 

Telecommunication  of  summarized  precinct  tallies  is  being  used  in 
many  jurisdictions  to  speed  up  processing  of  unofficial  results 
on  election  night.     For  this  application,   slower  speed  and  lower 
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cost  asynchronous  transmission  may  be  used.  Accuracy  protection 
using  parity  checks  with  retransmission  in  case  of  error  is  sat- 
isfactory for  this  application.  This  form  of  protection  is 
available  with  many  modems. 

If  data  is  to  be  transmitted  before  the  polls  close,  or  if  the 
transmitted  data  is  to  be  a  part  of  official,  final  results,  then 
more  protection  is  necessary.  In  these  cases,  the  standard  on 
computer  data  authentication,  previously  referenced  [34],  should 
be  used  to  assure  accuracy,  as  well  as  security,  in  the  transmis- 
sion of  the  data.  Synchronous  transmission  is  more  appropriate 
with  use  of  computer  data  authentication. 

6.16.7  Control  for  Vote  Summarization 

As  voting  results  are  received  from  specific  precincts,  these 
data  are  summarized  to  provide  candidate  totals.  Validity  checks 
should  be  used  to  assure  that  specific  votes  are  not  added  twice, 
or  not  added  to  the  wrong  precinct  total,  or  not  added  at  all. 
The  number  of  ballots  submitted  from  each  precinct,  as  identified 
by  precinct  officials,  should  be  entered  into  the  vote  summariz- 
ing system  and  compared  against  the  sum  of  candidate  votes  plus 
overvotes  and  undervotes  tallied  for  the  precinct.  Any  differ- 
ence of  more  than  three  should  trigger  a  review.  (Any  difference 
at  all  is  suspect,  but  given  the  current  limits  of  precinct  offi- 
cial and  ballot  reader  accuracy,  a  difference  of  three  may  be  the 
minimum  practical . ) 

6.16.8  Vote  Reconciliation  by  Contest 

In  each  vote-for-N  contest,  whether  N  is  one  or  any  higher  inte- 
ger, the  number  of  candidate  votes  plus  the  number  of  undervotes 
must  equal  N  times  the  number  of  non-overvoted  ballots.  The  num- 
ber of  non-overvoted  ballots  is  the  simply  the  total  number  of 
ballots  voted  for  the  contest  less  the  number  of  ballots  over- 
voted  for  the  contest. 

6.16.9  Recording  of  Undervotes  and  Overvotes 

Undervotes  and  overvotes  must  be  recorded  if  the  vote  summariza- 
tion and  reconciliation  controls  specified  above  are  to  be  accom- 
plished. The  effective  use  of  recounting  also  depends  on  the 
availability  of  this  data.  Recording  of  this  data  is  supportive 
of  GAO  standard  SI  on  Documentation  (see  section  5.4.5). 

6.16.10  Recounting 

A  manual  recount  of  one  percent  of  the  ballots  of  each  contest  is 
recommended.  The  right  of  selection  of  some  of  the  precincts  to 
be  recounted  should  be  granted  to  parties  or  candidates.  The 
parties  and  candidates  are  likely  to  propose  those  precincts 
about    whose    results    they    are    most    suspicious.       By  recounting 


119 


those  precincts,  more  confidence  in  the  final  results  is  likely. 

Ballots  may  be  recounted  on  a  different,  independently  managed 
machine  instead  of  being  recounted  by  hand.  Machine  recounting 
permits  a  larger  recount  with  considerably  less  effort.  If  a 
backup  machine  is  available,  and  that  is  recommended  as  a  good 
management  practice,  the  ballots  may  be  recounted  on  that  ma- 
chine. Further  confidence  in  the  recount  may  be  expected  if  the 
management  of  the  backup  machine  is  independent  of  the  organiza- 
tion managing  the  primary  machine  and  the  vote-tallying  software 
is  supplied  by  a  different  manufacturer.  An  independent  organi- 
zation could  be  considered  to  be  one  that  reports  to  a  different 
independently  elected  or  appointed  official  and  that  receives  an 
independent  budget. 

An  analysis  of  recounting  [105]  reveals  that  for  a  given  level  of 
confidence  in  the  results,  more  ballots  should  be  recounted  as 
the  opposing  candidate  vote  totals  become  more  equal.  As  the 
candidate  vote  totals  approach  equality,  the  recount  percentage 
for  any  confidence  level  approaches  100%.  This  result  is  what 
one  would  expect  intuitively,  and  in  practice,  a  full  recount  is 
often  demanded  (if  it  is  not  automatic)  by  at  least  one  candidate 
when  this  condition  occurs. 

The  referenced  analysis  employs  the  assumption  that  the  number  of 
voters  receiving  and  returning  ballots  is  well-documented,  so 
that  frauds  or  errors  involving  the  addition  or  subtraction  of 
ballots  could  not  be  successfully  perpetrated.  Any  reported  re- 
sult in  which  the  sum  of  candidate  votes  (plus  overvotes  and  un- 
dervotes)  is  not  equal  to  the  number  of  ballots  submitted  can  be 
immediately  identified  as  incorrect.  If  an  erroneous  result  is 
reported  in  which  the  total  of  candidate  votes  plus  overvotes  and 
undervotes  for  a  precinct  equals  the  number  of  ballots  submitted 
for  that  precinct,  the  error  must  be  due  to  a  switching  of  votes 
between  candidates  or  between  a  candidate  and  the  overvote  or  un- 
dervote  categories.  Thus,  the  complete  reconciliation  of  candi- 
date votes  and  overvotes  and  undervotes  with  ballots  cast  re- 
duces significantly  the  possibilities  for  the  reporting  of  in- 
correct results. 

The  referenced  analysis  shows  that  if  only  1%  of  the  precincts 
are  recounted  (the  rule  in  California  and  Texas,  for  example) , 
and  there  are  just  two  opposing  candidates  who  differ  by  only  1% 
of  the  total  vote,  there  is  only  a  probability  of  .655  (a  chance 
of  about  two  in  three)  of  finding  a  worst-case  error  that  might 
be  overturning  the  outcome  of  an  election  involving  1000  pre- 
cincts. For  there  to  be  a  99%  chance  of  finding  this  worst-case 
error  when  the  candidates  differ  by  1%  of  the  total  vote,  4.3%  of 
the  precincts  should  be  recounted,  assuming  a  1000-precinct 
situation. 

However,    the  kind  of  error  that   is  most  likely  to  occur  is  not 
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the  type  of  deliberate  and  sophisticated  scheme  that  would  re- 
quire the  full  percentage  recount  specified  in  the  analysis  in 
order  to  be  discovered.  With  a  less  sophisticated  type  of  error 
(such  as  the  accidental  miscounts  in  Carroll  County,  Maryland  and 
Moline,  Illinois  described  respectively  in  sections  4.1  and  4.8), 
a  smaller  recount  is  sufficient  for  discovery.  The  reason  that  a 
smaller  recount  is  sufficient  with  less  deliberate  errors  is  that 
the  errors  would  exist  more  widely  among  the  precincts,  and  so  a 
smaller  selection  of  precincts  for  recounting  would  be  necessary 
in  order  to  discover  the  error.  Unfortunately,  it  is  not  known 
in  advance  what  kind  of  error,  if  any,  exists  in  a  reported 
count . 

6 . 17  Application  Internal  Controls  For  PRE  Systems 

The  controls  proposed  for  ORE  systems  in  this  section  were  not 
included  in  the  1975  vote-tallying  report,  as  this  type  of  system 
was  only  just  becoming  operational  at  that  time.  In  the  1975  re- 
port, a  ORE  machine  was  called  a  "vote  summarizer." 

The  ORE  voting  machine  presents  a  special  application  internal 
control  problem.  As  discussed  in  section  3.7.2,  a  voter-choice 
set  recorded  by  the  machine  is  not  an  independent  document,  as  it 
is  created  by  the  machine,  not  by  the  voter.  The  set  of  votes 
displayed  by  the  machine  for  the  benefit  of  the  voter  during  the 
voting  process  may  not  be  the  set  of  votes  actually  used  by  the 
machine  for  summarization  and  inclusion  in  the  reported  results. 
By  design,  there  can  be  no  independent  verification  of  the  opera- 
tion of  the  machine.  For  some,  this  lack  of  an  audit  trail  for 
individual  transactions  is  unacceptable. 

Substitute  controls  for  the  unavailability  of  individual  voting 
records  should  include  convincing  demonstrations  that  each  ORE 
machine  operated  correctly,  that  is,  did  not  fail,  during  each 
voter's  use. 

6.17.1  Voter  Count  Match 

The  number  of  voters  recorded  by  each  machine  as  having  voted 
should  equal  the  number  of  voters  signed  in  to  vote  and  assigned 
to  that  machine  by  the  precinct  officials.  That  is,  records  of 
use  of  each  machine  should  be  individually  kept  by  the  precinct 
officials  in  order  to  permit  a  direct  match  with  the  machine  re- 
cords. 

6.17.2  Accuracy  of  Telecommunication  of  Voting  Data 

The  controls  are  identical  to  those  for  ballot-tallying  systems. 

6.17.3  Vote  Reconciliations 

With  a  record  of  each  undervote   (recommended  in  section  6.10.1), 
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two  vote  reconciliations  are  then  possible.  One  reconciliation 
should  demonstrate  an  equality  in  the  sum  of  the  number  of  votes 
and  undervotes  cast  by  each  voter  in  all  contests.  The  second 
reconciliation  considers  each  contest  separately,  and  should  de- 
monstrate that  the  sum  of  the  number  of  votes  and  undervotes  cast 
in  the  contest  is  consistent  with  the  number  of  voters  who  voted 
for  the  contest. 

First,  for  every  voter  using  the  same  ballot  style,  the  sum  of 
the  votes  and  undervotes  cast  is  the  same  number,  equal  to  the 
maximum  number  of  votes  that  could  have  been  cast  by  a  single 
voter  in  that  ballot  style.  This  simple  reconciliation  is  possi- 
ble only  because  overvotes  are  prevented.  A  similar  reconcilia- 
tion for  ballot-tallying  systems  is  more  complex  because,  in  gen- 
eral, overvotes  cannot  be  prevented. 

Secondly,  for  each  vote-for-N  contest  (N  may  be  one  or  any  higher 
integer) ,  the  number  of  votes  for  candidates  by  all  voters  plus 
the  number  of  undervotes  of  all  voters  should  equal  N  times  the 
number  of  voters  recorded  as  having  voted  in  the  contest. 

These  reconciliations  may  be  carried  out  for  each  individual  DRE 
machine,  as  well  as  for  groups  of  machines.  The  calculation  of 
these  reconciliations,  and  the  demonstration  of  the  equalities, 
should  provide  added  confidence  that  the  DRE  machines  were  per- 
forming correctly. 

6.17.4  Recounting  of  Voter-Choice  Sets 

If  the  machine-generated  voter-choice  sets  have  been  recorded  on 
removable  storage  media,  it  is  an  easy  matter  to  recompute  the 
machine-computed  vote  summaries.  It  is  recommended  that  this 
type  of  recount  be  carried  out  for  at  least  1%  of  the  precincts, 
using  the  complete  voter-choice  data  for  those  precincts.  The 
recount  should  be  carried  out  on  an  independently  programmed  com- 
puter for  which  the  removable  media  can  provide  data  input.  As 
pointed  out  in  section  3.7.2,  this  recount  checks  the  machine's 
summarization  process,  not  the  machine's  recording  of  the  voter's 
intent. 

6.17.5  Post-Election  Checkout 

Each  ballot  position  on  a  selected  percentage  of  DRE  machines 
used  in  an  election  should  be  test-voted  following  the  close  of 
polls,  to  assure  that  each  was  working  correctly.  Selection  of 
some  of  the  machines  to  be  tested  should  be  granted  to  parties  or 
candidates.  If  each  contest  on  each  machine  had  only  two  alter- 
natives, it  would  be  possible  to  test  each  ballot  position  with 
the  casting  of  just  two  ballots,  assuming  no  concern  for  interac- 
tion of  selections  in  different  contests.  As  some  contests  have 
more  alternatives,  more  than  two  ballots  would  need  to  be  cast  to 
check  all  possibilities. 
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6.18  The  Recommendations  In  Relation  To  The  Identified  Problems 


In  section  2.9,  the  problems  of  computerized  vote-tallying  were 
categorized  as  follows:  there  is  difficulty  in  verifying  report- 
ed results  (2.9.1),  there  is  the  possibility  of  undiscoverable 
frauds  (2.9.2),  and  election  administrators  lack  required  techni- 
cal knowledge  and  resources  (2.9.3).  The  existence  of  these 
problems  have  resulted  in  a  continuing  lack  of  confidence  by 
technically  qualified  observers  in  the  running  of  computerized 
elections. 

The  most  pertinent  recommendations  that  respond  to  these  problems 
are  that  the  concept  of  internal  control  should  be  extended  so  as 
to  be  applicable  to  vote-tallying,  and  that  persons  knowledgeable 
in  that  professional  field  should  be  utilized  to  assist  in  the 
establishment  of  sound  operational  procedures. 

Extension  of  internal  control  to  vote-tallying  requires  only  the 
re-definition  of  the  concept  of  a  transaction  so  that  it  is  ap- 
plicable to  non-financial  operations.  EDP  auditors  and  internal 
auditors  may  be  utilized  to  recommend  procedures  that  assure  that 
results  can  be  verified  and  that  the  possibility  of  undiscover- 
able frauds  is  minimized.  Specific  internal  controls  applicable 
to  vote-tallying  have  been  provided  above.  These  controls  re- 
spond to  the  potential  fraudulent  manipulations  identified  in 
section  2.9.2,  and  to  lack  of  audit  trails  and  poorly  implemented 
administrative  procedures,  specified  in  2.9.1,    (a)   and  (d) . 

With  the  use  of  the  services  of  knowledgeable  professionals  in 
internal  control  (which  includes  computer  security) ,  and  with  the 
efforts  of  sources  of  objective  technical  information  (such  as 
the  Election  Center) ,  election  administrators  would  not  be  per- 
ceived to  lack  the  technical  knowledge  and  resources  necessary  to 
overcome  problems  of  computer  use  that  cause  unease  about  report- 
ed results.  The  necessary  knowledge  required  to  assure  integrity 
of  the  vote-tallying  process  would  be  available  in-house.  Thus, 
administrative  errors  should  be  minimized  (2.9.3  (a))  and  control 
of  the  process  would  not  have  to  be  abdicated  (2.9.3  (b)  )  .  The 
public  would  be  able  to  receive  assurances  that  specific  threats 
to  system  integrity  were  being  adequately  handled.  Improved  con- 
fidence should  result  in  reduced  risk  to  vendors  entering  the 
market  (2.9.3  (d) ) ,  and  therefore  faster  introduction  of  more  ef- 
fective technology  (2.9.3   (e) ) . 

Other  recommendations  have  concerned  the  performance  of  vote  tal- 
lying hardware  and  software,  and  assurance  of  their  integrity. 
It  is  recommended  that  the  specifications  developed  by  the  FEC 
Clearinghouse  be  considered  for  adoption  by  each  State  when  they 
are  issued.  The  availability  of  these  performance  concepts  and 
specifications  provides  election  administrators  with  additional 
knowledge  and  resources  that  can  be  used  to  acquire  effectively 
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operating  vote-tallying  systems.  This  responds  to  the  concern 
specified  in  section  2.9.3   (c) . 

Tests  of  logical  correctness  of  vote-tallying  software  are  recom- 
mended as  part  of  a  certification  process,  and  recommendations 
are  made  concerning  the  treatment  of  all  software  to  minimize  the 
possibility  that  operations  will  be  modified  fraudulently  by  hid- 
den code.  The  implementation  of  these  recommendations  should 
provide  additional  confidence  in  the  integrity  of  the  systems 
used  to  report  election  results.  The  certification  process,  in- 
cluding its  tests  for  logical  correctness,  responds  specifically 
to  the  concerns  about  the  design  of  computer  programs  and  their 
unavailability  to  the  scrutiny  of  responsible  officials.  These 
concerns  were  identified  in  sections  2.9.1  (b)   and  (c) . 
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U.S.  GOVERNMENT  PRINTING  OFFICE:  198&-  201-597  92553 


Technical  Publications 


Periodical 


Journal  of  Research — The  Journal  of  Research  of  the  National  Bureau  of  Standards  reports  NBS  research 
and  development  in  those  disciplines  of  the  physical  and  engineering  sciences  in  which  the  Bureau  is  active. 
These  include  physics,  chemistry,  engineering,  mathematics,  and  computer  sciences.  Papers  cover  a  broad 
range  of  subjects,  with  major  emphasis  on  measurement  methodology  and  the  basic  technology  underlying 
standardization.  Also  included  from  time  to  time  are  survey  articles  on  topics  closely  related  to  the  Bureau's 
technical  and  scientific  programs.  Issued  six  times  a  year. 


Nonperiodicals 


Monographs — Major  contributions  to  the  technical  literature  on  various  subjects  related  to  the  Bureau's  scien- 
tific and  technical  activities. 

Handbooks — Recommended  codes  of  engineering  and  industrial  practice  (including  safety  codes)  developed  in 
cooperation  with  interested  industries,  professional  organizations,  and  regulatory  bodies. 

Special  Publications — Include  proceedings  of  conferences  sponsored  by  NBS,  NBS  annual  reports,  and  other 
special  publications  appropriate  to  this  grouping  such  as  wall  charts,  pocket  cards,  and  bibliographies. 

Applied  Mathematics  Series — Mathematical  tables,  manuals,  and  studies  of  special  interest  to  physicists, 
engineers,  chemists,  biologists,  mathematicians,  computer  programmers,  and  others  engaged  in  scientific  and 
technical  work. 

National  Standard  Reference  Data  Series — Provides  quantitative  data  on  the  physical  and  chemical  properties 
of  materials,  compiled  from  the  world's  literature  and  critically  evaluated.  Developed  under  a  woridwide  pro- 
gram coordinated  by  NBS  under  the  authority  of  the  National  Standard  Data  Act  (Public  Law  90-3%). 
NOTE:  The  Journal  of  Physical  and  Chemical  Reference  Data  (JPCRD)  is  published  quarterly  for  NBS  by 
the  American  Chemical  Society  (ACS)  and  the  American  Institute  of  Physics  (AIP).  Subscriptions,  reprints, 
and  supplements  are  available  from  ACS,  1155  Sixteenth  St.,  NW,  Washington,  DC  20056. 

Building  Science  Series — Disseminates  technical  information  developed  at  the  Bureau  on  building  materials, 
components,  systems,  and  whole  structures.  The  series  presents  research  results,  test  methods,  and  perfor- 
mance criteria  related  to  the  structural  and  environmental  functions  and  the  durability  and  safety 
characteristics  of  building  elements  and  systems. 

Technical  Notes — Studies  or  reports  which  are  complete  in  themselves  but  restrictive  in  their  treatment  of  a 
subject.  Analogous  to  monographs  but  not  so  comprehensive  in  scope  or  definitive  in  treatment  of  the  subject 
area.  Often  serve  as  a  vehicle  for  final  reports  of  work  performed  at  NBS  under  the  sponsorship  of  other 
government  agencies. 

Voluntary  Product  Standards — Develop)ed  under  procedures  published  by  the  Department  of  Commerce  in 
Part  10,  Title  15,  of  the  Code  of  Federal  Regulations.  The  standards  establish  nationally  recognized  re- 
quirements for  products,  and  provide  all  concerned  interests  with  a  basis  for  common  understanding  of  the 
characteristics  of  the  products.  NBS  administers  this  program  as  a  supplement  to  the  activities  of  the  private 
sector  standardizing  organizations. 

Consumer  Information  Series — Practical  information,  based  on  NBS  research  and  experience,  covering  areas 
of  interest  to  the  consumer.  Easily  understandable  language  and  illustrations  provide  useful  background 
knowledge  for  shopping  in  today's  technological  marketplace. 

Order  the  above  NBS  publications  from:  Superintendent  of  Documents,  Government  Printing  Office, 
Washington,  DC  20402. 

Order  the  following  NBS  publications — FIPS  and  NBSIR  's—from  the  National  Technical  Information  Ser- 
vice, Springfield,  VA  22161. 

Federal  Information  Processing  Standards  Publications  (FIPS  PUB) — Publications  in  this  series  collectively 
constitute  the  Federal  Information  Processing  Standards  Register.  The  Register  serves  as  the  official  source  of 
information  in  the  Federal  Government  regarding  standards  issued  by  NBS  pursuant  to  the  Federal  Property 
and  Administrative  Services  Act  of  1949  as  amended.  Public  Law  89-306  (79  Stat.  1127),  and  as  implemented 
by  Executive  Order  11717  (38  FR  12315,  dated  May  11,  1973)  and  Part  6  of  Title  15  CFR  (Code  of  Federal 
Regulations). 

NBS  Interagency  Reports  (NBSIR) — A  special  series  of  interim  or  final  reports  on  work  performed  by  NBS 
for  outside  sponsors  (both  government  and  non -government).  In  general,  initial  distribution  is  handled  by  the 
sponsor;  public  distribution  is  by  the  National  Technical  Information  Service,  Springfield,  VA  22161,  in  paper 
copy  or  microfiche  form. 
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